CVE-2026-54713: CVE-2026-54713: Idempotency Key Collision and Silent Job Dropping in cakephp/queue

CVE-2026-54713: Idempotency Key Collision and Silent Job Dropping in cakephp/queue

Vulnerability ID: CVE-2026-54713
CVSS Score: 3.7
Published: 2026-08-27

An incomplete array comparison vulnerability in cakephp/queue version 0.1.11 through 2.3.0 allows unauthenticated attackers to cause key collisions in unique job deduplication. This is caused by standard array value sorting that discards associative keys, normalizing different payload keys to identical arrays and leading to a denial of service (DoS) by dropping legitimate jobs.

TL;DR

A key-erasure flaw in cakephp/queue's deduplication mechanism allows distinct job parameters to resolve to identical unique hashes, enabling attackers to silently drop legitimate background jobs.

---

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-1023
• Attack Vector: Network (AC: High)
• CVSS Score: 3.7
• EPSS Score: 0.00
• Impact: Availability (Low)
• Exploit Status: Proof-of-Concept / None
• KEV Status: Not Listed

Affected Systems

• cakephp/queue
• cakephp/queue: >= 0.1.11, < 2.3.1 (Fixed in: 2.3.1)

Code Analysis

Commit: 1389059

Introduce recursive ksort to preserve keys during serialization in unique ID generation

Mitigation Strategies

• Upgrade cakephp/queue to version 2.3.1 or newer
• Implement strict validation schemas for job parameters to prevent arbitrary key injections
• Avoid utilizing user-controlled values directly in background job arguments when duplicate prevention is enabled

Remediation Steps:

1. Locate composer.json in your application root directory
2. Update the dependency version: change 'cakephp/queue' requirement to '^2.3.1' or newer
3. Run 'composer update cakephp/queue' to fetch and apply the updated dependency package
4. Execute unit and integration tests to ensure that existing queue configurations work correctly with recursive key sorting

References

• GitHub Security Advisory GHSA-r5pm-vrc5-3m73
• Fix Commit
• Pull Request #188
• Tag / Release v2.3.1
• CVE Record

---

Read the full report for CVE-2026-54713 on our website for more details including interactive diagrams and full exploit analysis.

Comments

[Luis Cruz]

It's interesting to see how an incomplete array comparison could lead to such significant operational issues in cakephp/queue. Implementing recursive ksort to maintain key integrity seems like a solid fix to prevent these job drops. As a best practice, I also recommend reviewing all parts of your job parameter handling to mitigate future vulnerabilities—especially if user inputs are involved. If you're looking for assistance with implementing these changes or further enhancing security measures, I’d be glad to explore a paid collaboration. What other strategies do you think could strengthen the overall resilience of job queues?