EUVD-2026-20967
GHSA-hwr4-mq23-wcv5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft topic selector with underscore character
-
ExploitTrigger cache key collision in TopicSelectorStore
-
ExecutionPoison match result cache
-
ImpactDeliver private updates to unauthorized subscribers
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Hardware access control
|
| Exploitation Conditions | Requires authenticated user with subscription privileges to TopicSelectorStore in affected application. Attacker must craft topic selectors and topics containing underscores to create cache key collisions, poisoning the match result cache to redirect private updates to unauthorized subscribers or block authorized delivery. |
| Impact | Cache key collision in topic selector matching enables authorization bypass for private message delivery. Attackers with publish or subscribe access can craft topic names to collide with legitimate selectors, poisoning cached match results. This affects confidentiality and integrity of message routing. Severity depends on deployment: systems relying on topic-based access control face direct compromise; workaround (disabling cache) available but incurs performance cost. |
| Exploit ScenarioDerived | Attacker subscribes with selector 'foo' targeting 'bar_baz' topic. Simultaneously publishes private update to 'foo_bar' topic with 'baz' suffix, generating identical cache key 'm_foo_bar_baz'. Cached collision causes private update intended for 'foo_bar'/'baz' pair to route to unauthorized 'foo'/'bar_baz' subscriber. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
Cache key collision in Mercure hub TopicSelectorStore enables authorization bypass through crafted topic names. Attackers can poison the match result cache by exploiting underscore-based key concatenation, causing private updates to be delivered to unauthorized subscribers or blocking legitimate deliveries. Affects Go package github.com/dunglas/mercure prior to version 0.22.0. Exploitation requires ability to subscribe to the hub or publish updates with specially crafted topic/selector combinations. No public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade to Mercure version 0.22.0 or later, which implements collision-free typed struct cache keys. Commit 4964a69be904fd61e35b5f1e691271663b6fdd64 contains the fix. Release available at https://github.com/dunglas/mercure/releases/tag/v0.22.0. Workaround for unpatched systems: disable topic selector cache by setting topic_selector_cache to -1 in Caddyfile configuration, or pass cache size 0 when using the library directly. This eliminates vulnerability but degrades performance. Vendor advisory: https://github.com/dunglas/mercure/security/advisories/GHSA-hwr4-mq23-wcv5
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-1289 collision stems from string concatenation cache key generation (topicSelector + "_" + topic). Underscore separator creates ambiguity: "foo_bar"+"baz" and "foo"+"bar_baz" produce identical key "m_foo_bar_baz". Fix replaces string keys with typed Go struct keys containing separate topicSelector and topic fields, eliminating concatenation-based collisions. Otter cache implementation replaces sharded cache abstraction.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N
Primary rating from Vendor (https://github.com/dunglas/mercure).
CVSS VectorVendor: https://github.com/dunglas/mercure
Lifecycle Timeline
2DescriptionCVE.org
Impact
A cache key collision vulnerability in TopicSelectorStore allows an attacker to poison the match result cache, potentially causing private updates to be delivered to unauthorized subscribers or blocking delivery to authorized ones.
The cache key was constructed by concatenating the topic selector and topic with an underscore separator:
k = "m_" + topicSelector + "_" + topicBecause both topic selectors and topics can contain underscores, two distinct pairs can produce the same key:
selector="foo_bar" topic="baz" → key: "m_foo_bar_baz"
selector="foo" topic="bar_baz" → key: "m_foo_bar_baz"An attacker who can subscribe to the hub or publish updates with crafted topic names can exploit this to bypass authorization checks on private updates.
Patches
The vulnerability is fixed by replacing string-encoded cache keys with typed Go struct keys that are inherently collision-free:
type matchCacheKey struct {
topicSelector string
topic string
}The internal TopicSelectorStoreCache interface and sharded cache abstraction have also been removed in favor of a single typed otter cache.
Users should upgrade to version 0.22.0 or later.
Workarounds
Disable the topic selector cache by setting topic_selector_cache to -1 in the Caddyfile, or by passing a cache size of 0 when using the library directly. This eliminates the vulnerability at the cost of reduced performance.
Executive ViewAI
Mercure hub versions prior to 0.22.0 contain a cache key collision vulnerability that allows attackers with publish or subscribe permissions to bypass authorization controls and deliver private updates to unauthorized users or block legitimate message delivery. This directly undermines the confidentiality and integrity guarantees of real-time messaging infrastructure, potentially exposing sensitive data to unauthorized parties.
Apply vendor patch to version 0.22.0 or later.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Exploit-DB