CVE-2026-106971
Deferred Deferred - Pending Action

Integer Overflow in rybakit/msgpack BufferUnpacker Causes DoS

Publication date: 2026-10-28

Last updated on: 2026-10-28

Assigner: MITRE

Description
An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack v0.11.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-28
Last Modified
2026-10-28
Generated
2026-10-28
AI Q&A
2026-10-28
EPSS Evaluated
N/A
NVD
CVE-2026-106971
EUVD
EUVD-2026-112134

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a n/a n/a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an integer overflow in the MessagePack BufferUnpacker component of rybakit/msgpack v0.11.0. An integer overflow occurs when a calculation exceeds the maximum limit of an integer type, causing unexpected behavior. In this case, attackers can exploit this to cause a Denial of Service (DoS) by sending specially crafted input data.

Impact Analysis

The impact includes potential system crashes or unresponsiveness due to the DoS condition. If exploited, it could disrupt services relying on the MessagePack library, leading to downtime or degraded performance for applications using this component.

Mitigation Strategies

Update the rybakit/msgpack library to a version that fixes the integer overflow in MessagePack\BufferUnpacker. Avoid processing untrusted MessagePack input until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106971. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart