CVE-2026-39972

mercure has Topic Selector Cache Key Collision

Workarounds

Disable the topic selector cache by setting topic_selector_cache to -1 in the Caddyfile, or by passing a cache size of 0 when using the library directly. This eliminates the vulnerability at the cost of reduced performance.

A cache key collision vulnerability in TopicSelectorStore allows an attacker to poison the match result cache, potentially causing private updates to be delivered to unauthorized subscribers or blocking delivery to authorized ones.

The cache key was constructed by concatenating the topic selector and topic with an underscore separator:

k = "m_" + topicSelector + "_" + topic

Because both topic selectors and topics can contain underscores, two distinct pairs can produce the same key:

selector="foo_bar"  topic="baz"     → key: "m_foo_bar_baz"
selector="foo"      topic="bar_baz" → key: "m_foo_bar_baz"

An attacker who can subscribe to the hub or publish updates with crafted topic names can exploit this to bypass authorization checks on private updates.

Kodem intelligence

Already deployed Kodem?

The vulnerability is fixed by replacing string-encoded cache keys with typed Go struct keys that are inherently collision-free:

type matchCacheKey struct {
    topicSelector string
    topic         string
}

The internal TopicSelectorStoreCache interface and sharded cache abstraction have also been removed in favor of a single typed otter cache.

Users should upgrade to version 0.22.0 or later.

1. What is CVE-2026-39972? CVE-2026-39972 is a high-severity security vulnerability in github.com/dunglas/mercure (go), affecting versions < 0.22.0. It is fixed in 0.22.0.
2. Which versions of github.com/dunglas/mercure are affected by CVE-2026-39972? github.com/dunglas/mercure (go) versions < 0.22.0 is affected.
3. Is there a fix for CVE-2026-39972? Yes. CVE-2026-39972 is fixed in 0.22.0. Upgrade to this version or later.
4. Is CVE-2026-39972 exploitable, and should I be worried? Whether CVE-2026-39972 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-39972 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-39972? Upgrade github.com/dunglas/mercure to 0.22.0 or later.