Uncontrolled recursion in MessagePack\BufferUnpacker::unpack() in rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service through memory exhaustion when an application decodes deeply nested, attacker-controlled MessagePack input.
References
Configurations
No configuration.
History
30 Oct 2026, 18:17
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-674 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| References | () https://github.com/diptendukar/security-advisories/blob/main/CVE-2026-106972.md - |
29 Oct 2026, 17:17
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) Uncontrolled recursion in MessagePack\BufferUnpacker::unpack() in rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service through memory exhaustion when an application decodes deeply nested, attacker-controlled MessagePack input. |
28 Oct 2026, 15:24
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-28 15:17
Updated : 2026-10-30 18:17
NVD link : CVE-2026-106972
Mitre link : CVE-2026-106972
CVE.ORG link : CVE-2026-106972
JSON object : View
Products Affected
No product.
CWE
CWE-674
Uncontrolled Recursion