n/a · denial of service

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-106971 · CVE overview and exploitation status

cve-program · CVE-2026-106971

• https://github.com/rybakit/msgpack.php
• https://github.com/rybakit/msgpack.php/releases/tag/v0.11.0
• https://github.com/diptendukar/security-advisories/blob/main/CVE-2026-106971.md

• An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service via crafted MessagePack input when the application runs on 32-bit PHP · Advisory content revised · 29 Oct 2026