p PatchFirst

CVE-2026-54713

CVE-2026-54713 · CakePHP Queue: Incomplete Comparison in getUniqueId vulnerable to collisions

This page contains facts from public vulnerability sources. Check the original advisory before updating.

CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated attacker who can influence job parameters can submit semantically different data that produces the same identifier, resulting in legitimate jobs dropped as duplicate collisions. This issue is fixed in version 2.3.1.

CVSS 3.7 · Low · EPSS 0.5% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • queue

    Versions
    • >= 0.1.11, < 2.3.1: Affected

    No fix published

  • cakephp/queue Packagist

    Versions
    • 0.1.10
    • 0.1.11
    • 0.1.12
    • 0.1.13
    • 0.1.14
    • 0.1.15
    • 1.0.0
    • 1.1.0
    • 2.0.1
    • 2.1.0
    • 2.2.0
    • 2.3.0
    Affected ranges
    • ECOSYSTEM: ≥ 0.1.10, < 2.3.1

    Update to 2.3.1

Original sources

Check your server →