Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for queue by cakephp

    CVE-2026-54713 (GCVE-0-2026-54713)

    Vulnerability from nvd – Published: 2026-08-27 17:03 – Updated: 2026-08-28 15:55
    VLAI
    Title
    CakePHP Queue: Incomplete Comparison in getUniqueId vulnerable to collisions
    Summary
    CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated attacker who can influence job parameters can submit semantically different data that produces the same identifier, resulting in legitimate jobs dropped as duplicate collisions. This issue is fixed in version 2.3.1.
    Severity
    3.7 (Low)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-28 15:55 UTC
    CWE
    • CWE-1023 - Incomplete Comparison with Missing Factors
    Assigner
    References
    Impacted products
    Vendor Product Version
    cakephp queue Affected: >= 0.1.11, < 2.3.1
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54713",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T15:55:07.774512Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T15:55:52.105Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "queue",
          "vendor": "cakephp",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.1.11, \u003c 2.3.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated attacker who can influence job parameters can submit semantically different data that produces the same identifier, resulting in legitimate jobs dropped as duplicate collisions. This issue is fixed in version 2.3.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1023",
              "description": "CWE-1023: Incomplete Comparison with Missing Factors",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T17:03:31.580Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/cakephp/queue/security/advisories/GHSA-r5pm-vrc5-3m73",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/cakephp/queue/security/advisories/GHSA-r5pm-vrc5-3m73"
        },
        {
          "name": "https://github.com/cakephp/queue/pull/188",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cakephp/queue/pull/188"
        },
        {
          "name": "https://github.com/cakephp/queue/commit/13890591e248acc8824becb24ba1939fa061bd34",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cakephp/queue/commit/13890591e248acc8824becb24ba1939fa061bd34"
        },
        {
          "name": "https://github.com/cakephp/queue/releases/tag/2.3.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cakephp/queue/releases/tag/2.3.1"
        }
      ],
      "source": {
        "advisory": "GHSA-r5pm-vrc5-3m73",
        "discovery": "UNKNOWN"
      },
      "title": "CakePHP Queue: Incomplete Comparison in getUniqueId vulnerable to collisions"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54713",
    "datePublished": "2026-08-27T17:03:31.580Z",
    "dateReserved": "2026-06-15T22:58:06.563Z",
    "dateUpdated": "2026-08-28T15:55:52.105Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-54713 (GCVE-0-2026-54713)

    Vulnerability from cvelistv5 – Published: 2026-08-27 17:03 – Updated: 2026-08-28 15:55
    VLAI
    Title
    CakePHP Queue: Incomplete Comparison in getUniqueId vulnerable to collisions
    Summary
    CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated attacker who can influence job parameters can submit semantically different data that produces the same identifier, resulting in legitimate jobs dropped as duplicate collisions. This issue is fixed in version 2.3.1.
    Severity
    3.7 (Low)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-28 15:55 UTC
    CWE
    • CWE-1023 - Incomplete Comparison with Missing Factors
    Assigner
    References
    Impacted products
    Vendor Product Version
    cakephp queue Affected: >= 0.1.11, < 2.3.1
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54713",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T15:55:07.774512Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T15:55:52.105Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "queue",
          "vendor": "cakephp",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.1.11, \u003c 2.3.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated attacker who can influence job parameters can submit semantically different data that produces the same identifier, resulting in legitimate jobs dropped as duplicate collisions. This issue is fixed in version 2.3.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1023",
              "description": "CWE-1023: Incomplete Comparison with Missing Factors",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T17:03:31.580Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/cakephp/queue/security/advisories/GHSA-r5pm-vrc5-3m73",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/cakephp/queue/security/advisories/GHSA-r5pm-vrc5-3m73"
        },
        {
          "name": "https://github.com/cakephp/queue/pull/188",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cakephp/queue/pull/188"
        },
        {
          "name": "https://github.com/cakephp/queue/commit/13890591e248acc8824becb24ba1939fa061bd34",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cakephp/queue/commit/13890591e248acc8824becb24ba1939fa061bd34"
        },
        {
          "name": "https://github.com/cakephp/queue/releases/tag/2.3.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cakephp/queue/releases/tag/2.3.1"
        }
      ],
      "source": {
        "advisory": "GHSA-r5pm-vrc5-3m73",
        "discovery": "UNKNOWN"
      },
      "title": "CakePHP Queue: Incomplete Comparison in getUniqueId vulnerable to collisions"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54713",
    "datePublished": "2026-08-27T17:03:31.580Z",
    "dateReserved": "2026-06-15T22:58:06.563Z",
    "dateUpdated": "2026-08-28T15:55:52.105Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}