CVE-2026-106971 in msgpack.php
Summary
by MITRE • 10/28/2026
An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack v0.11.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in rybakit/msgpack version 0.11.0 represents a critical security flaw within the MessagePack\BufferUnpacker component, specifically manifesting as an integer overflow during the parsing and unpacking of serialized data structures. This issue arises when the library processes crafted input that contains malformed or maliciously constructed length fields for arrays, maps, or binary strings. The underlying technical mechanism involves a failure to properly validate arithmetic operations related to buffer sizes before allocating memory or initializing internal buffers. When an attacker supplies a value that exceeds the maximum limit of the integer type used by the language runtime, such as PHP's signed 32-bit or 64-bit integers depending on the environment, the calculation wraps around to a negative number or a significantly smaller positive number than intended. This arithmetic error leads the unpacker to allocate insufficient memory or attempt to access out-of-bounds buffer regions, triggering an unhandled exception that crashes the application process.
From a technical perspective, this flaw is classified under CWE-190, which denotes Integer Overflow or Wraparound. The vulnerability allows for a Denial of Service attack because the resulting crash terminates the current execution context, such as a PHP-FPM worker or a CLI script handling MessagePack data. In web applications that rely on rybakit/msgpack to deserialize incoming API payloads or session data, this can lead to service unavailability if multiple requests are sent with maliciously crafted inputs designed to trigger the overflow repeatedly. The impact is particularly severe in high-throughput environments where resource exhaustion due to repeated crashes can degrade system stability and availability for legitimate users. There is no indication of remote code execution potential from this specific integer overflow, as it primarily results in a crash rather than arbitrary memory write operations that could be exploited for control flow hijacking.
The operational impact centers on the reliability and availability of services dependent on MessagePack deserialization. Attackers can exploit this vulnerability by sending specially crafted binary data to any endpoint or service interface that accepts MessagePack formatted input without rigorous validation prior to unpacking. This includes REST APIs, RPC endpoints, or internal microservices communicating via MessagePack. The lack of bounds checking in the BufferUnpacker component means that even seemingly valid-looking structures can trigger the overflow if their declared lengths are manipulated to exceed safe arithmetic limits. Consequently, organizations relying on this library for efficient data serialization must treat untrusted input as potentially malicious and implement strict validation layers before invoking the unpacking functions provided by rybakit/msgpack.
To mitigate this vulnerability, immediate action is required to update the rybakit/msgpack dependency to a patched version where integer overflow checks have been implemented in the BufferUnpacker logic. Developers should ensure that all inputs destined for MessagePack deserialization are validated against expected size constraints before being passed to the unpacking routine. Additionally, implementing input validation at the application layer using allowlists for message types and maximum payload sizes can provide defense-in-depth protection. Monitoring system logs for unhandled exceptions related to buffer overflows or integer arithmetic errors can also aid in detecting exploitation attempts. Aligning with industry standards such as CWE-190 helps categorize this flaw correctly, while considering ATT&CK techniques like T1498 Network Denial of Service highlights the strategic importance of patching此类 vulnerabilities to maintain service continuity and resilience against automated denial-of-service campaigns targeting common libraries.