CVE-2026-106972

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-106972", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-10-30T17:14:25.522Z", "dateReserved": "2026-10-07T00:00:00.000Z", "datePublished": "2026-10-28T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-29T17:11:33.896Z"}, "descriptions": [{"lang": "en", "value": "Uncontrolled recursion in MessagePack\\BufferUnpacker::unpack() in rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service through memory exhaustion when an application decodes deeply nested, attacker-controlled MessagePack input."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/rybakit/msgpack.php"}, {"url": "https://github.com/rybakit/msgpack.php/releases/tag/v0.11.0"}, {"url": "https://github.com/diptendukar/security-advisories/blob/main/CVE-2026-106972.md"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-674", "lang": "en", "description": "CWE-674 Uncontrolled Recursion"}]}], "references": [{"url": "https://github.com/diptendukar/security-advisories/blob/main/CVE-2026-106972.md", "tags": ["exploit"]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-30T16:49:31.253012Z", "id": "CVE-2026-106972", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T17:14:25.522Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-106972", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-10-30T17:14:25.522Z", "dateReserved": "2026-10-07T00:00:00.000Z", "datePublished": "2026-10-28T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-29T17:11:33.896Z"}, "descriptions": [{"lang": "en", "value": "Uncontrolled recursion in MessagePack\\BufferUnpacker::unpack() in rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service through memory exhaustion when an application decodes deeply nested, attacker-controlled MessagePack input."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/rybakit/msgpack.php"}, {"url": "https://github.com/rybakit/msgpack.php/releases/tag/v0.11.0"}, {"url": "https://github.com/diptendukar/security-advisories/blob/main/CVE-2026-106972.md"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-106972", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-30T16:49:31.253012Z"}}}], "references": [{"url": "https://github.com/diptendukar/security-advisories/blob/main/CVE-2026-106972.md", "tags": ["exploit"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-674", "description": "CWE-674 Uncontrolled Recursion"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T16:49:55.782Z"}}]}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Uncontrolled recursion in MessagePack\\BufferUnpacker::unpack() in rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service through memory exhaustion when an application decodes deeply nested, attacker-controlled MessagePack input."}], "id": "CVE-2026-106972", "lastModified": "2026-10-30T18:17:17.780", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-106972", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-30T16:49:31.253012Z", "version": "2.0.3"}}]}, "published": "2026-10-28T15:17:02.690", "references": [{"source": "cve@mitre.org", "url": "https://github.com/diptendukar/security-advisories/blob/main/CVE-2026-106972.md"}, {"source": "cve@mitre.org", "url": "https://github.com/rybakit/msgpack.php"}, {"source": "cve@mitre.org", "url": "https://github.com/rybakit/msgpack.php/releases/tag/v0.11.0"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/diptendukar/security-advisories/blob/main/CVE-2026-106972.md"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-674"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "rybakit/msgpack: rybakit/msgpack: Denial of Service via uncontrolled recursion", "id": "2562917", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562917"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["Uncontrolled recursion in MessagePack\\BufferUnpacker::unpack() in rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service through memory exhaustion when an application decodes deeply nested, attacker-controlled MessagePack input.", "A flaw was found in rybakit/msgpack. An attacker can cause a Denial of Service (DoS) by supplying specially crafted input to the data unpacking component. Due to uncontrolled recursion, processing this malicious input leads to excessive resource exhaustion and crashes the application."], "name": "CVE-2026-106972", "public_date": "2026-10-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-106972\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-106972\nhttps://github.com/diptendukar/security-advisories/blob/main/CVE-2026-106972.md\nhttps://github.com/rybakit/msgpack.php\nhttps://github.com/rybakit/msgpack.php/releases/tag/v0.11.0"], "statement": "This vulnerability is rated as Important because an unauthenticated remote attacker can cause an application crash and memory exhaustion without requiring elevated privileges or user interaction. In Red Hat environments, rybakit/msgpack is not provided as part of standard operating system installations, restricting exposure to custom deployments that accept and unpack untrusted serialized streams.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.11.0"}}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "msgpack.php", "vendor": "rybakit"}], "created": "2026-10-28T16:30:15.962313+00:00", "updated": "2026-11-06T02:15:18.166024+00:00", "vendors": ["rybakit", "rybakit$PRODUCT$msgpack.php"]}