CVE-2026-106972 in msgpack
Summary
by MITRE • 10/28/2026
An uncontrolled recursion in the MessagePack\BufferUnpacker::unpack() component of rybakit/msgpack v0.11.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified as an uncontrolled recursion within the rybakit/msgpack library, specifically affecting version 0.11.0 in its MessagePack\BufferUnpacker::unpack() component, represents a significant risk to application stability and availability. This flaw stems from insufficient validation of input data structures during the deserialization process. When the unpacking function processes a specially crafted MessagePack payload containing deeply nested or self-referential data structures, it triggers recursive calls without adequate depth limits or cycle detection mechanisms. In standard programming practices, recursion requires strict boundary conditions to prevent stack overflow; however, in this implementation, the lack of such safeguards allows the call stack to grow exponentially until system resources are exhausted.
From a technical perspective, this issue is classified under CWE-675, which denotes operations with uncontrolled number of iterations or depth. The core mechanism involves the BufferUnpacker class attempting to resolve complex nested arrays and maps defined in the MessagePack binary format. Because the library does not enforce a maximum recursion depth for unpacking these structures, an attacker can construct a payload that forces the application into an infinite loop of recursive function calls. This behavior consumes CPU cycles rapidly and depletes memory resources allocated to the thread handling the request, leading directly to a Denial of Service condition where the affected service becomes unresponsive or crashes entirely.
The operational impact of this vulnerability is severe for any system relying on rybakit/msgpack for processing MessagePack data, particularly in web applications or microservices that accept user-supplied input without rigorous sanitization prior to deserialization. An attacker can exploit this flaw remotely by sending a maliciously crafted HTTP request containing the recursive payload. The resulting resource exhaustion affects not only the specific process handling the request but potentially the entire host if shared resources are impacted, leading to service outages and potential data loss due to abrupt termination of ongoing transactions. This aligns with ATT&CK technique T1496, Resource Hijacking, where adversaries consume computational resources to degrade performance or cause denial of service against targeted systems.
Mitigation strategies must focus on both immediate patching and long-term architectural improvements. The primary remediation is to upgrade the rybakit/msgpack library to a version that includes fixes for this recursion limit issue, ensuring that developers utilize maintained software with proper input validation logic in place. Additionally, implementing strict rate limiting and request size restrictions at the network or application gateway level can help mitigate the impact of such attacks by preventing excessively large or complex payloads from reaching the vulnerable component. For environments where immediate patching is not feasible, deploying a Web Application Firewall rule to detect and block MessagePack payloads with abnormally high nesting levels provides an effective compensating control against exploitation attempts.