Junglewise Threat Intelligence

CVE-2026-11330: thedotmack claude-mem weak hash in Observation Content Hash Handler

CVE-2026-11330 · Severity: low · CVSS 3.6 · Published 2026-06-05

Executive brief

claude-mem is a popular open-source tool that captures and compresses agent activity across sessions to provide persistent context. The tool uses a hash function to store and retrieve observation data, but a weakness in this hashing mechanism allows attackers to create different observations that produce identical hashes. While the attack requires local system access and is difficult to execute, it could enable data tampering or bypass of integrity checks that the application relies on.

Technical details

The vulnerability stems from the use of a weak hash function in the computeObservationContentHash function within src/services/sqlite/observations/store.ts. The root cause is the lack of proper delimiters or encoding when combining observation fields before hashing, which allows an attacker to craft different inputs that hash to the same value (CWE-327: Use of a Broken or Risky Cryptographic Algorithm). The attack vector is local-only with high complexity; an attacker must have direct access to the system and must carefully craft malicious observation payloads. The impact is limited to integrity of cached observation data. The fix, released in version 12.0.0, introduces a null-byte delimiter in the hashing logic (commit f32fda8b35e9fe9329f87da65c31149362a03f97) to eliminate collision possibilities.

Affected products

  • thedotmack claude-mem up to 11.0.1

Timeline

  • 2026-06-05: disclosed
  • 2026-04-07: patched: Fix merged in PR #1494
  • 2026-06-05: advisory

References