cakephp/queue · Security
cakephp/queue's Incomplete Comparison in getUniqueId vulnerable to collisions
- GHSA ID
- GHSA-r5pm-vrc5-3m73
- CVE ID
- CVE-2026-54713
- Severity
- low
- Published
- Updated
- CVSS
- 3.7 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
- CVSS v3
- 3.7 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Description
Impact
For jobs with shouldBeUnique = true the queue plugin will generate a 'unique identifier' based on the job class, method and parameters. If user data is supplied, a malicious user could create collisions, resulting in legitimate jobs being dropped.
Patches
Upgrade to 2.3.1
Workarounds
You can disable shouldBeUnique and handle idempotency in application code.
CWEs
- CWE-1023 · Incomplete Comparison with Missing Factors
References
- https://github.com/cakephp/queue/security/advisories/GHSA-r5pm-vrc5-3m73 ↗
- https://github.com/cakephp/queue/pull/188 ↗
- https://github.com/cakephp/queue/commit/13890591e248acc8824becb24ba1939fa061bd34 ↗
- https://github.com/cakephp/queue/releases/tag/2.3.1 ↗
- https://github.com/advisories/GHSA-r5pm-vrc5-3m73 ↗