The flaw occurs in LMCache’s hex_hash_to_int16 function, part of the KV Cache Handler, which converts hexadecimal data into a 16‑bit hash. This weak hash (CWE‑327, CWE‑328) can produce collisions when two different inputs generate the same hash value. An attacker who can manipulate the input locally may force such a collision; it is inferred that this could lead to cache entry overwrites or corruption, although the description does not explicitly confirm such outcomes. The vulnerability is limited to environments where code can be run locally, requires high complexity, and its exploitability is considered difficult. A public exploit has been released, but it is only usable on systems hosting LMCache versions up to 0.5.4, and the issue is mitigated by upgrading to 0.5.5.

LMCache users running versions up to 0.5.4 are affected. The vulnerable component is lmcache/integration/vllm/utils.py within the open‑source LMCache project. The issue is present in all distributions of this version range until a patch is released beyond 0.5.4.

The CVSS score is 2, indicating low overall severity, and EPSS score is < 1%. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires local execution and is considered difficult, with high complexity. A public exploit has already been published, but the attack vector is limited to environments where an attacker can run code locally against the LMCache service.