{"id":"CVE-2026-39972","sourceIdentifier":"security-advisories@github.com","published":"2026-04-09T17:16:30.770","lastModified":"2026-10-26T21:10:00.170","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Mercure is a protocol for pushing data updates to web browsers and other HTTP clients in a battery-efficient way. Prior to 0.22.0, a cache key collision vulnerability in TopicSelectorStore allows an attacker to poison the match result cache, potentially causing private updates to be delivered to unauthorized subscribers or blocking delivery to authorized ones. The cache key was constructed by concatenating the topic selector and topic with an underscore separator. Because both topic selectors and topics can contain underscores, two distinct pairs can produce the same key. An attacker who can subscribe to the hub or publish updates with crafted topic names can exploit this to bypass authorization checks on private updates. This vulnerability is fixed in 0.22.0."},{"lang":"es","value":"Mercure es un protocolo para enviar actualizaciones de datos a navegadores web y otros clientes HTTP de una manera eficiente en el uso de la batería. Antes de la versión 0.22.0, una vulnerabilidad de colisión de clave de caché en TopicSelectorStore permite a un atacante envenenar la caché de resultados de coincidencia, lo que podría causar que actualizaciones privadas se entreguen a suscriptores no autorizados o bloquear la entrega a los autorizados. La clave de caché se construía concatenando el selector de tema y el tema con un separador de guion bajo. Debido a que tanto los selectores de tema como los temas pueden contener guiones bajos, dos pares distintos pueden producir la misma clave. Un atacante que puede suscribirse al hub o publicar actualizaciones con nombres de tema manipulados puede explotar esto para eludir las comprobaciones de autorización en actualizaciones privadas. Esta vulnerabilidad está corregida en la versión 0.22.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"dunglas","product":"mercure","versions":[{"version":"< 0.22.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-04-09T18:59:15.857679Z","id":"CVE-2026-39972","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1289"}]}],"references":[{"url":"https://github.com/dunglas/mercure/commit/4964a69be904fd61e35b5f1e691271663b6fdd64","source":"security-advisories@github.com"},{"url":"https://github.com/dunglas/mercure/security/advisories/GHSA-hwr4-mq23-wcv5","source":"security-advisories@github.com"}]}