CVE-2026-39972

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39972", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-08T00:01:47.627Z", "datePublished": "2026-04-09T16:42:22.903Z", "dateUpdated": "2026-04-09T18:59:49.306Z"}, "containers": {"cna": {"title": "Mercure has a Topic Selector Cache Key Collision", "problemTypes": [{"descriptions": [{"cweId": "CWE-1289", "lang": "en", "description": "CWE-1289: Improper Validation of Unsafe Equivalence in Input", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/dunglas/mercure/security/advisories/GHSA-hwr4-mq23-wcv5", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/dunglas/mercure/security/advisories/GHSA-hwr4-mq23-wcv5"}, {"name": "https://github.com/dunglas/mercure/commit/4964a69be904fd61e35b5f1e691271663b6fdd64", "tags": ["x_refsource_MISC"], "url": "https://github.com/dunglas/mercure/commit/4964a69be904fd61e35b5f1e691271663b6fdd64"}], "affected": [{"vendor": "dunglas", "product": "mercure", "versions": [{"version": "< 0.22.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-09T16:42:22.903Z"}, "descriptions": [{"lang": "en", "value": "Mercure is a protocol for pushing data updates to web browsers and other HTTP clients in a battery-efficient way. Prior to 0.22.0, a cache key collision vulnerability in TopicSelectorStore allows an attacker to poison the match result cache, potentially causing private updates to be delivered to unauthorized subscribers or blocking delivery to authorized ones. The cache key was constructed by concatenating the topic selector and topic with an underscore separator. Because both topic selectors and topics can contain underscores, two distinct pairs can produce the same key. An attacker who can subscribe to the hub or publish updates with crafted topic names can exploit this to bypass authorization checks on private updates. This vulnerability is fixed in 0.22.0."}], "source": {"advisory": "GHSA-hwr4-mq23-wcv5", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-09T18:59:15.857679Z", "id": "CVE-2026-39972", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-09T18:59:49.306Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-39972", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-09T18:59:15.857679Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-09T18:59:29.607Z"}}], "cna": {"title": "Mercure has a Topic Selector Cache Key Collision", "source": {"advisory": "GHSA-hwr4-mq23-wcv5", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "dunglas", "product": "mercure", "versions": [{"status": "affected", "version": "< 0.22.0"}]}], "references": [{"url": "https://github.com/dunglas/mercure/security/advisories/GHSA-hwr4-mq23-wcv5", "name": "https://github.com/dunglas/mercure/security/advisories/GHSA-hwr4-mq23-wcv5", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/dunglas/mercure/commit/4964a69be904fd61e35b5f1e691271663b6fdd64", "name": "https://github.com/dunglas/mercure/commit/4964a69be904fd61e35b5f1e691271663b6fdd64", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Mercure is a protocol for pushing data updates to web browsers and other HTTP clients in a battery-efficient way. Prior to 0.22.0, a cache key collision vulnerability in TopicSelectorStore allows an attacker to poison the match result cache, potentially causing private updates to be delivered to unauthorized subscribers or blocking delivery to authorized ones. The cache key was constructed by concatenating the topic selector and topic with an underscore separator. Because both topic selectors and topics can contain underscores, two distinct pairs can produce the same key. An attacker who can subscribe to the hub or publish updates with crafted topic names can exploit this to bypass authorization checks on private updates. This vulnerability is fixed in 0.22.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1289", "description": "CWE-1289: Improper Validation of Unsafe Equivalence in Input"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-09T16:42:22.903Z"}}}, "cveMetadata": {"cveId": "CVE-2026-39972", "state": "PUBLISHED", "dateUpdated": "2026-04-09T18:59:49.306Z", "dateReserved": "2026-04-08T00:01:47.627Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-09T16:42:22.903Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "mercure", "vendor": "dunglas", "versions": [{"status": "affected", "version": "< 0.22.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mercure is a protocol for pushing data updates to web browsers and other HTTP clients in a battery-efficient way. Prior to 0.22.0, a cache key collision vulnerability in TopicSelectorStore allows an attacker to poison the match result cache, potentially causing private updates to be delivered to unauthorized subscribers or blocking delivery to authorized ones. The cache key was constructed by concatenating the topic selector and topic with an underscore separator. Because both topic selectors and topics can contain underscores, two distinct pairs can produce the same key. An attacker who can subscribe to the hub or publish updates with crafted topic names can exploit this to bypass authorization checks on private updates. This vulnerability is fixed in 0.22.0."}, {"lang": "es", "value": "Mercure es un protocolo para enviar actualizaciones de datos a navegadores web y otros clientes HTTP de una manera eficiente en el uso de la bater\u00eda. Antes de la versi\u00f3n 0.22.0, una vulnerabilidad de colisi\u00f3n de clave de cach\u00e9 en TopicSelectorStore permite a un atacante envenenar la cach\u00e9 de resultados de coincidencia, lo que podr\u00eda causar que actualizaciones privadas se entreguen a suscriptores no autorizados o bloquear la entrega a los autorizados. La clave de cach\u00e9 se constru\u00eda concatenando el selector de tema y el tema con un separador de guion bajo. Debido a que tanto los selectores de tema como los temas pueden contener guiones bajos, dos pares distintos pueden producir la misma clave. Un atacante que puede suscribirse al hub o publicar actualizaciones con nombres de tema manipulados puede explotar esto para eludir las comprobaciones de autorizaci\u00f3n en actualizaciones privadas. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 0.22.0."}], "id": "CVE-2026-39972", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39972", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-09T18:59:15.857679Z", "version": "2.0.3"}}]}, "published": "2026-04-09T17:16:30.770", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/dunglas/mercure/commit/4964a69be904fd61e35b5f1e691271663b6fdd64"}, {"source": "security-advisories@github.com", "url": "https://github.com/dunglas/mercure/security/advisories/GHSA-hwr4-mq23-wcv5"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1289"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.22.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "mercure", "source": "cna", "vendor": "dunglas"}, "product": "mercure", "vendor": "dunglas"}], "analysis": {"en": {"generated_at": "2026-04-09T18:50:36.896039+00:00", "value": {"mitigation_remediation": ["Update Mercure to version 0.22.0 or newer.", "If an upgrade is delayed, isolate the hub to trusted networks and disable public subscription and publishing endpoints.", "Validate or sanitize topic selector and topic inputs to prevent cache key collisions.", "Monitor subscription and publication logs for anomalous patterns that may indicate attempted cache poisoning."], "summary": {"action": "Immediate Patch", "impact": "Authorization Bypass / Information Disclosure"}, "threat_synthesis": {"affected_systems": "All instances of Mercure by dunglas released before version 0.22.0 are affected. The two\u2011part key collision flaw does not discriminate between sub\u2011releases, so any hub running a pre\u20110.22.0 release is vulnerable until the upgrade is applied.", "description_and_impact": "A cache key collision exists in the TopicSelectorStore component of the Mercure protocol. The key is built by concatenating a topic selector with a topic using an underscore separator; because both strings can contain underscores, two distinct selector\u2011topic pairs can produce the same key. When this collision occurs, the match result cache can hold inaccurate data, enabling an attacker to have private updates delivered to unauthorized subscribers or to block delivery to authorized ones. This results in bypassing authorization checks and potentially exposing confidential information.", "risk_and_exploitability": "The CVSS vector assigns a score of 7.1, indicating a medium severity vulnerability. EPSS data is not available, and the flaw is not listed in CISA\u2019s KEV catalog. The likely attack vector is remote engagement through the hub\u2019s subscription or publication endpoints, which an attacker can access over the network. Based on the description, it is inferred that an attacker must be able to send crafted subscription requests or publish messages with specially formed topic selectors and topics containing underscores. Once such a collision is created, the bug can affect all users who interact with the hub, so the risk is notable for publicly exposed or poorly secured instances of Mercure."}}}}, "created": "2026-04-10T08:52:55.938193+00:00", "updated": "2026-04-10T09:32:07.859663+00:00", "vendors": ["dunglas", "dunglas$PRODUCT$mercure"]}