Most recent entries from all

fkie_cve-2026-54713

2026-09-29T05:41:45.589307+00:00

CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated attacker who can influence job parameters can submit semantically different data that produces the same identifier, resulting in legitimate jobs dropped as duplicate collisions. This issue is fixed in version 2.3.1.

GHSA-r5pm-vrc5-3m73 — cakephp/queue's Incomplete Comparison in getUniqueId vulnerable to collisions

2026-09-29T05:41:45.589644+00:00

Affected: Packagist: cakephp/queue

### Impact

For jobs with `shouldBeUnique = true` the queue plugin will generate a 'unique identifier' based on the job class, method and parameters. If user data is supplied, a malicious user could create collisions, resulting in legitimate jobs being dropped.

### Patches Upgrade to 2.3.1

### Workarounds

You can disable `shouldBeUnique` and handle idempotency in application code.