GHSA-r5pm-vrc5-3m73

Suggest an improvement
Source
https://github.com/advisories/GHSA-r5pm-vrc5-3m73
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-r5pm-vrc5-3m73/GHSA-r5pm-vrc5-3m73.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-r5pm-vrc5-3m73
Aliases
Published
2026-08-27T17:03:56Z
Modified
2026-08-27T17:25:39Z
Severity
  • 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
cakephp/queue's Incomplete Comparison in getUniqueId vulnerable to collisions
Details

Impact

For jobs with shouldBeUnique = true the queue plugin will generate a 'unique identifier' based on the job class, method and parameters. If user data is supplied, a malicious user could create collisions, resulting in legitimate jobs being dropped.

Patches

Upgrade to 2.3.1

Workarounds

You can disable shouldBeUnique and handle idempotency in application code.

Database specific 
{
    "cwe_ids": [
        "CWE-1023"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-27T17:03:56Z",
    "nvd_published_at": null,
    "severity": "LOW"
}
References

Affected packages

Packagist / cakephp/queue

Package

Name
cakephp/queue
Purl
pkg:composer/cakephp/queue

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0.1.10
Fixed
2.3.1

Affected versions

0.*
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14
0.1.15
1.*
1.0.0
1.1.0
2.*
2.0.1
2.1.0
2.2.0
2.3.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-r5pm-vrc5-3m73/GHSA-r5pm-vrc5-3m73.json"