An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of serv

Summary

An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service via crafted MessagePack input when the application runs on 32-bit PHP

Remediation

1. Inventory every Unknown product deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Referencehttps://github.com/diptendukar/security-advisories/blob/main/CVE-2026-106971.md
• Referencehttps://github.com/rybakit/msgpack.php
• Referencehttps://github.com/rybakit/msgpack.php/releases/tag/v0.11.0