CVE-2026-54713: 
PHP vulnerability analysis and mitigation

CVE-2026-54713 is an incomplete comparison vulnerability in the CakePHP Queue library (cakephp/queue) that allows unauthenticated attackers to cause legitimate jobs to be silently dropped via hash collisions. The flaw exists in QueueManager::getUniqueId(), which generates deduplication identifiers for jobs with shouldBeUnique = true using the job class, method, and parameters — but the original implementation used PHP's sort(), which discards associative array keys. Affected versions span from 0.1.10 through 2.3.0 (inclusive); version 2.3.1 contains the fix. It carries a CVSS v3.1 base score of 3.7 (Low) (GitHub Advisory, CakePHP Security Advisory). The vulnerability was originally reported on June 16, 2026, and published to the GitHub Advisory Database on August 27, 2026.

The root cause is classified as CWE-1023 (Incomplete Comparison with Missing Factors). In the vulnerable code, QueueManager::getUniqueId() called PHP's sort($data) on the job parameter array before hashing it with MD5. PHP's sort() reindexes arrays and discards string keys, meaning two associative arrays with different key-value semantics but the same values (e.g., ['user_id' => 'admin', 'role' => 'guest'] vs. ['foo' => 'admin', 'bar' => 'guest']) could produce identical sorted value sequences and thus the same MD5 hash. The fix replaces sort() with a recursive key-based sort (ksort) via a new sortUniqueValues() method, ensuring that both keys and values are preserved in the canonical representation (GitHub Commit, GitHub Advisory). Exploitation requires that the application accepts user-controlled data as job parameters for jobs with shouldBeUnique = true.

Successful exploitation causes a denial-of-service condition limited to the job queue: an attacker who can influence job parameters can craft inputs that collide with the unique identifier of a legitimate pending job, causing the legitimate job to be silently dropped as a duplicate. There is no confidentiality or integrity impact — no data is exposed or modified — and the availability impact is scoped to the queue processing functionality rather than the broader system (GitHub Advisory, CakePHP Security Advisory). The practical severity depends heavily on how critical the affected job types are to application operations (e.g., email delivery, payment processing, notifications).

No public proof-of-concept exploit code, exploit kits, or evidence of in-the-wild exploitation have been reported for this vulnerability. The attack complexity is rated High, as exploitation requires the attacker to understand the job parameter structure and craft inputs that produce a specific hash collision. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no EPSS score data is currently available. The vulnerability was responsibly disclosed by Volker Dusch and the PHP Ecosystem security team (GitHub PR #188).

1. Reconnaissance: Identify a CakePHP application using cakephp/queue versions >= 0.1.10 and < 2.3.1 that accepts user-controlled input as parameters for jobs configured with shouldBeUnique = true.
2. Understand job parameter structure: Determine the associative array keys and values used by the target job class and method (e.g., through API documentation, source code review, or behavioral analysis).
3. Craft colliding parameters: Construct an alternative associative array whose values, when sorted by PHP's sort() (value-only, key-discarding), produce the same ordered sequence as the legitimate job's parameters. For example, if the legitimate job uses ['user_id' => 'admin', 'role' => 'guest'], craft ['foo' => 'admin', 'bar' => 'guest'] — both sort to ['admin', 'guest'].
4. Submit the malicious job: Submit the crafted job parameters through the application's normal job submission interface (e.g., a web form, API endpoint, or any user-facing feature that enqueues jobs).
5. Trigger collision: The getUniqueId() function generates the same MD5 hash for both the legitimate and malicious job, causing the queue to treat the legitimate job as a duplicate and drop it silently (GitHub Advisory, GitHub Commit).

• Logs: Unexpected or elevated rate of jobs being silently skipped or marked as duplicate in queue processing logs, particularly for job classes with shouldBeUnique = true.
• Application Behavior: Legitimate background tasks (e.g., emails, notifications, payment processing) failing to execute despite being submitted, with no corresponding error logs.
• Queue Monitoring: Anomalous patterns of job submissions with unusual or unexpected parameter key names that differ from application norms but carry the same values as expected jobs.

Upgrade cakephp/queue to version 2.3.1 or later, which replaces the flawed sort() call with a recursive key-preserving sort (ksort) in getUniqueId() (CakePHP Release 2.3.1). As a temporary workaround, disable shouldBeUnique on affected job classes and implement idempotency checks within the application code itself (CakePHP Security Advisory). Additionally, restrict user-controlled input from being passed directly as job parameters where possible to reduce the attack surface.

The vulnerability was responsibly reported by Volker Dusch and the PHP Ecosystem security team, and was acknowledged in the fix commit by CakePHP maintainer markstory (GitHub PR #188). No significant broader media coverage or notable community discussion beyond the GitHub advisory and pull request has been observed, consistent with the Low severity rating.