CVE-2026-107296: msgpack5: Decoding negative int64 values mutates the input buffer

October 8, 2026

Decoding a negative signed 64-bit integer modifies the corresponding bytes in the caller-provided input buffer. Applications that retain or reuse encoded input for integrity checks, logging, or subsequent processing may observe silently corrupted data.

Positive integers and other MessagePack value types are not affected.

References

github.com/advisories/GHSA-qw35-55vc-rhgj
github.com/mcollina/msgpack5/commit/82b70393a824e1088a45a377548d1d9ab82faf91
github.com/mcollina/msgpack5/releases/tag/v6.1.0
github.com/mcollina/msgpack5/security/advisories/GHSA-qw35-55vc-rhgj
nvd.nist.gov/vuln/detail/CVE-2026-107296

Code Behaviors & Features

Detect and mitigate CVE-2026-107296 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →