CVE-2026-106972: An uncontrolled recursion in the MessagePack\BufferUnpacker::unpack() component of rybakit/msgpack v0.11.0 allows attackers to cause a Denial of Service (DoS) via a crafted input

Unscored severity · published Oct 28, 2026

CVE-2026-106972

An uncontrolled recursion in the MessagePack\BufferUnpacker::unpack() component of rybakit/msgpack v0.11.0 allows attackers to cause a Denial of Service (DoS) via a crafted input

New

–

CVSS

–

EPSS

No

On KEV

Description

An uncontrolled recursion in the MessagePack\BufferUnpacker::unpack() component of rybakit/msgpack v0.11.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.

Exploitation

Is it being used?

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-106972

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-106972

github.com

https://github.com/rybakit/msgpack.php

github.com

https://github.com/rybakit/msgpack.php/releases/tag/v0.11.0

github.com

https://github.com/diptendukar/security-advisories/blob/main/CVE-2026-106972.md