Cache Key Collision Vulnerability in Mercure Protocol by Dunglas
CVE-2026-39972

7.1HIGH

Key Information:

Vendor

Dunglas

Status
Mercure
Vendor
CVE Published:
9 April 2026

What is CVE-2026-39972?

A cache key collision vulnerability in the Mercure protocol's TopicSelectorStore allows attackers to manipulate the match result cache. This could lead to unauthorized delivery of private updates or disrupt authorized deliveries. The vulnerability arises from the construction of cache keys using underscores in both topic selectors and topics, allowing distinct combinations to yield the same key. Exploitation can occur if an attacker subscribes to the hub or publishes updates with specially crafted topic names, bypassing authorization checks on sensitive updates. The issue has been addressed in version 0.22.0.

Affected Version(s)

mercure < 0.22.0

References

https://github.com/dunglas/mercure/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/dunglas/mercure/commit/4964a69be904fd6...
x_refsource_MISC

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.