n/a · denial of service

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-106972 · CVE overview and exploitation status

cve-program · CVE-2026-106972

• https://github.com/rybakit/msgpack.php
• https://github.com/rybakit/msgpack.php/releases/tag/v0.11.0
• https://github.com/diptendukar/security-advisories/blob/main/CVE-2026-106972.md

• Uncontrolled recursion in MessagePack\BufferUnpacker::unpack() in rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service through memory exhaustion when an application decodes deeply nested, attacker-controlle… · Advisory content revised · 29 Oct 2026