{"id":"UBUNTU-CVE-2026-106972","details":"Uncontrolled recursion in MessagePack\\BufferUnpacker::unpack() in rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service through memory exhaustion when an application decodes deeply nested, attacker-controlled MessagePack input.","modified":"2026-10-31T03:30:06.351064787Z","published":"2026-10-30T00:00:00Z","upstream":["CVE-2026-106972"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-106972"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-106972"},{"type":"REPORT","url":"https://github.com/diptendukar/security-advisories/blob/main/CVE-2026-106972.md"},{"type":"REPORT","url":"https://github.com/rybakit/msgpack.php"},{"type":"REPORT","url":"https://github.com/rybakit/msgpack.php/releases/tag/v0.11.0"}],"affected":[{"package":{"name":"msgpack","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/msgpack?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.5.7-3ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_name":"libmsgpack3","binary_version":"0.5.7-3ubuntu1"},{"binary_name":"libmsgpackc2","binary_version":"0.5.7-3ubuntu1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-106972.json"}}],"schema_version":"1.9.2","severity":[{"type":"Ubuntu","score":"medium"}]}