Vulnerabilities in pkg:golang/github.com/dunglas/mercure
PACKAGECVE-2026-39972 is a HIGH mercure has topic selector cache vulnerability (CWE-1289: Improper Validation of Unsafe Equivalence in Input) affecting Github.com/dunglas/mercure libraries in the Go ecosystem. The issue involves mercure has topic selector cache key collision. Remediation is available by upgrading affected packages to version 0.22.0.
pkg:golang/github.com/dunglas/mercure
Vulnerability advisories affecting package pkg:golang/github.com/dunglas/mercure. Select an advisory below to view technical details or fixes.
| Advisory ID | CVE / NVD | Severity | Summary |
|---|---|---|---|
| GHSA-hwr4-mq23-wcv5 | CVE-2026-39972 | HIGH | mercure has Topic Selector Cache Key Collision |
CVE-2026-39972 at a Glance
How to Fix CVE-2026-39972
To remediate this vulnerability, upgrade all affected Github.com/dunglas/mercure dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/dunglas/mercure to 0.22.0Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/dunglas/mercureHow to Check if You Are Affected
To determine whether your application is affected by CVE-2026-39972, inspect your project dependencies for Github.com/dunglas/mercure:
inspect dependencies for github.com/dunglas/mercureAnalyze the terminal output to locate any version of Github.com/dunglas/mercure in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.22.0), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-1289: Improper Validation of Unsafe Equivalence in Input, where the product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value. In Github.com/dunglas/mercure, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-39972 Affected Github.com/dunglas/mercure Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/dunglas/mercure
|
Go |
< 0.22.0
|
0.22.0
|
References
Frequently Asked Questions
What is CVE-2026-39972?
Which Github.com/dunglas/mercure versions are affected?
What version fixes CVE-2026-39972?
Is github.com/dunglas/mercure affected?
What CWE is associated with CVE-2026-39972?
How can I check Go dependencies for CVE-2026-39972?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-hwr4-mq23-wcv5",
"modified" : "2026-04-09T19:05:40Z",
"published" : "2026-04-08T19:53:20Z",
"aliases" : [ "CVE-2026-39972" ],
"summary" : "mercure has Topic Selector Cache Key Collision",
"details" : "### Impact\n\nA cache key collision vulnerability in `TopicSelectorStore` allows an attacker to poison the match result cache, potentially causing private updates to be delivered to unauthorized subscribers or blocking delivery to authorized ones.\n\nThe cache key was constructed by concatenating the topic selector and topic with an underscore separator:\n\n```go\nk = \"m_\" + topicSelector + \"_\" + topic\n```\n\nBecause both topic selectors and topics can contain underscores, two distinct pairs can produce the same key:\n\n```\nselector=\"foo_bar\" topic=\"baz\" → key: \"m_foo_bar_baz\"\nselector=\"foo\" topic=\"bar_baz\" → key: \"m_foo_bar_baz\"\n```\n\nAn attacker who can subscribe to the hub or publish updates with crafted topic names can exploit this to bypass authorization checks on private updates.\n\n### Patches\n\nThe vulnerability is fixed by replacing string-encoded cache keys with typed Go struct keys that are inherently collision-free:\n\n```go\ntype matchCacheKey struct {\n topicSelector string\n topic string\n}\n```\n\nThe internal `TopicSelectorStoreCache` interface and sharded cache abstraction have also been removed in favor of a single typed otter cache.\n\nUsers should upgrade to version **0.22.0** or later.\n\n### Workarounds\n\nDisable the topic selector cache by setting `topic_selector_cache` to `-1` in the Caddyfile, or by passing a cache size of `0` when using the library directly. This eliminates the vulnerability at the cost of reduced performance.",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/dunglas/mercure"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "0.22.0"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/dunglas/mercure/security/advisories/GHSA-hwr4-mq23-wcv5"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-39972"
}, {
"type" : "WEB",
"url" : "https://github.com/dunglas/mercure/commit/4964a69be904fd61e35b5f1e691271663b6fdd64"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/dunglas/mercure"
}, {
"type" : "WEB",
"url" : "https://github.com/dunglas/mercure/releases/tag/v0.22.0"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-1289" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-04-08T19:53:20Z",
"nvd_published_at" : "2026-04-09T17:16:30Z"
}
}