Description

CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated attacker who can influence job parameters can submit semantically different data that produces the same identifier, resulting in legitimate jobs dropped as duplicate collisions. This issue is fixed in version 2.3.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-08-27T20:17:49.670Z",
  "pubdate": "2026-08-27T20:17:49.670Z",
  "executiveSummary": "A vulnerability identified in CakePHP Queue (versions 0.1.11 through 2.3.1) allows for the generation of identical unique identifiers for semantically distinct job parameters.\nThis flaw, localized within the QueueManager::getUniqueId() function, stems from improper serialization logic where associative array keys are discarded during the sorting process of job parameters.\nAn unauthenticated attacker capable of influencing input parameters can deliberately trigger identifier collisions for jobs where 'shouldBeUnique' is enabled.\nThe primary impact of this vulnerability is a Denial of Service (DoS) condition at the application queue level, where legitimate jobs are erroneously discarded as duplicate entries.\nThis vulnerability does not require authenticated access, making it highly exploitable if the application exposes job-submission endpoints to external or untrusted users.\nThe risk implication is a potential disruption of background processing pipelines, preventing critical tasks from executing successfully due to forced collision-based suppression.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the QueueManager::getUniqueId() method, which is responsible for creating a hash identifier to enforce job uniqueness constraints.\nWhen processing job arguments, the system attempts to normalize the parameters to ensure consistency; however, the implementation of this normalization involves an operation that sorts the array of parameters while failing to preserve associative keys.\nBecause the logic discards these keys during the sorting process, two distinct sets of data that differ only by key mapping—but share identical values—will result in an identical identifier string.\nThe attack flow begins with an attacker identifying a queue-based function where they can provide input that influences the parameters of a job marked with 'shouldBeUnique'.\nBy constructing a malicious payload where the values of an associative array are identical to those of a legitimate job but arranged with different keys (or by exploiting the key-stripping behavior), the attacker triggers the collision.\nThe QueueManager, upon evaluating the incoming job, calculates the hash using the flawed sorting logic. Because the resulting identifier matches an existing entry in the queue, the system assumes a duplicate submission is taking place.\nConsequently, the queue processing logic suppresses the second job to prevent redundancy. By strategically injecting these payloads, an attacker can continuously block or 'shadow' legitimate operations from entering the queue.\nThis vulnerability is present in versions 0.1.11 up to 2.3.1. The lack of authentication requirements at the point of influence means that any endpoint providing public access to queue submission mechanisms is potentially exposed to this manipulation.\nPost-exploitation impact manifests as a service-level failure where specific queue tasks are prevented from executing, potentially leading to data processing halts, notification failures, or other business logic interruptions depending on the role of the impacted jobs.\nThe vulnerability highlights a critical failure in the canonicalization process of serialization, where data integrity is compromised by the destruction of key-value associations during the hashing phase."
}