{"vulnerability": "cve-2026-54713", "sightings": [{"uuid": "0e7e4deb-3a43-4c98-9b5f-75d707c9ad91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54713", "type": "seen", "source": "https://gist.github.com/alon710/95bf554559835da78ddd9ef64b2fd7a2", "content": "# CVE-2026-54713: CVE-2026-54713: Idempotency Key Collision and Silent Job Dropping in cakephp/queue\n\n> **CVSS Score:** 3.7\n> **Published:** 2026-08-27\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54713\n\n## Summary\nAn incomplete array comparison vulnerability in cakephp/queue version 0.1.11 through 2.3.0 allows unauthenticated attackers to cause key collisions in unique job deduplication. This is caused by standard array value sorting that discards associative keys, normalizing different payload keys to identical arrays and leading to a denial of service (DoS) by dropping legitimate jobs.\n\n## TL;DR\nA key-erasure flaw in cakephp/queue's deduplication mechanism allows distinct job parameters to resolve to identical unique hashes, enabling attackers to silently drop legitimate background jobs.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1023\n- **Attack Vector**: Network (AC: High)\n- **CVSS Score**: 3.7\n- **EPSS Score**: 0.00\n- **Impact**: Availability (Low)\n- **Exploit Status**: Proof-of-Concept / None\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- cakephp/queue\n- **cakephp/queue**: >= 0.1.11, < 2.3.1 (Fixed in: `2.3.1`)\n\n## Mitigation\n\n- Upgrade cakephp/queue to version 2.3.1 or newer\n- Implement strict validation schemas for job parameters to prevent arbitrary key injections\n- Avoid utilizing user-controlled values directly in background job arguments when duplicate prevention is enabled\n\n**Remediation Steps:**\n1. Locate composer.json in your application root directory\n2. Update the dependency version: change 'cakephp/queue' requirement to '^2.3.1' or newer\n3. Run 'composer update cakephp/queue' to fetch and apply the updated dependency package\n4. Execute unit and integration tests to ensure that existing queue configurations work correctly with recursive key sorting\n\n## References\n\n- [GitHub Security Advisory GHSA-r5pm-vrc5-3m73](https://github.com/cakephp/queue/security/advisories/GHSA-r5pm-vrc5-3m73)\n- [Fix Commit](https://github.com/cakephp/queue/commit/13890591e248acc8824becb24ba1939fa061bd34)\n- [Pull Request #188](https://github.com/cakephp/queue/pull/188)\n- [Tag / Release v2.3.1](https://github.com/cakephp/queue/releases/tag/2.3.1)\n- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-54713)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54713) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-28T01:31:29.551350Z"}]}