CVE-2026-107296: CWE-471: Modification of Assumed-Immutable Data (MAID) in mcollina msgpack5
Description
### Impact Decoding a negative signed 64-bit integer modifies the corresponding bytes in the caller-provided input buffer. Applications that retain or reuse encoded input for integrity checks, logging, or subsequent processing may observe silently corrupted data. Positive integers and other MessagePack value types are not affected. ### Patches The decoder now computes signed 64-bit values without writing to the input buffer. ### Workarounds Copy untrusted MessagePack input before decoding it, or do not retain or reuse input buffers after decoding.
CVSS v3.1
Score 3.7low
Affected software
mcollina
msgpack5
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in msgpack5 versions before 6.1.0 involves modification of assumed-immutable data during decoding of negative signed 64-bit integers. Specifically, the decoding process alters the bytes in the input buffer provided by the caller, which can cause silent data corruption if the input buffer is reused or retained. This behavior does not affect positive integers or other MessagePack value types. The problem is addressed by updating to msgpack5 version 6.1.0.
Potential Impact
Applications using vulnerable versions of msgpack5 that retain or reuse encoded input buffers for integrity verification, logging, or subsequent processing may encounter silent data corruption. This can undermine data integrity checks and potentially cause incorrect application behavior. The vulnerability does not impact confidentiality or availability and only affects integrity with a low severity rating (CVSS 3.7).
Mitigation Recommendations
Upgrade to msgpack5 version 6.1.0 or later, where this issue is fixed. No other mitigation is indicated or necessary as the vulnerability is resolved in the official fix.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-07T15:53:23.587Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac7d1292cdf04f6562ba9ae
Added to database: 10/08/2026, 17:21:45 UTC
Last enriched: 10/08/2026, 17:33:52 UTC
Last updated: 10/08/2026, 21:48:50 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.