CVE-2026-10813

LMCache KV Cache utils.py hex_hash_to_int16 weak hash

View on CVE.org
Published Jun 4, 2026 CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Description
A flaw has been found in LMCache up to 0.5.4. This affects the function hex_hash_to_int16 of the file lmcache/integration/vllm/utils.py of the component KV Cache Handler. Executing a manipulation can lead to use of weak hash. The attack needs to be launched locally. The attack requires a high level of complexity. It is indicated that the exploitability is difficult. The exploit has been published and may be used. Upgrading to version 0.5.5 is able to mitigate this issue. This patch is called ce08eea76ce5898200efee55f4932fd07a7cabeb. It is suggested to upgrade the affected component. A contributor of the project confirms: "hex_hash_to_int16() was introduced in 0.3.1 (PR #882, commit f5174701). It is not present in 0.3.0, and it is still present in 0.4.7 through 0.5.4."

Analysis

AI-generated

Technical impact

The flaw occurs in LMCache’s hex_hash_to_int16 function, part of the KV Cache Handler, which converts hexadecimal data into a 16‑bit hash. This weak hash (CWE‑327, CWE‑328) can produce collisions when two different inputs generate the same hash value. An attacker who can manipulate the input locally may force such a collision; it is inferred that this could lead to cache entry overwrites or corruption, although the description does not explicitly confirm such outcomes. The vulnerability is limited to environments where code can be run locally, requires high complexity, and its exploitability is considered difficult. A public exploit has been released, but it is only usable on systems hosting LMCache versions up to 0.5.4, and the issue is mitigated by upgrading to 0.5.5.

Affected Systems

LMCache users running versions up to 0.5.4 are affected. The vulnerable component is lmcache/integration/vllm/utils.py within the open‑source LMCache project. The issue is present in all distributions of this version range until a patch is released beyond 0.5.4.

Risk and Exploitability

The CVSS score is 2, indicating low overall severity, and EPSS score is < 1%. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires local execution and is considered difficult, with high complexity. A public exploit has already been published, but the attack vector is limited to environments where an attacker can run code locally against the LMCache service.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the pending patch by upgrading to LMCache version 0.5.5 or newer once the pull request is merged and released.
  • Restrict local administrative access to the machines that host LMCache, ensuring that only trusted users can run code on these hosts.
  • Monitor the project’s issue tracker and pull‑request status so that the fix can be applied as soon as it becomes available.

Generated by OpenCVE AI on October 17, 2026 at 10:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-3hh9-752g-5g22 LMCache: 16-bit multimodal hash collision can poison KV cache entries
History
Type Values Removed Values Added
References
Type Values Removed Values Added
Description A flaw has been found in LMCache up to 0.4.6. This affects the function hex_hash_to_int16 of the file lmcache/integration/vllm/utils.py of the component KV Cache Handler. Executing a manipulation can lead to use of weak hash. The attack needs to be launched locally. The attack requires a high level of complexity. It is indicated that the exploitability is difficult. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance. A flaw has been found in LMCache up to 0.5.4. This affects the function hex_hash_to_int16 of the file lmcache/integration/vllm/utils.py of the component KV Cache Handler. Executing a manipulation can lead to use of weak hash. The attack needs to be launched locally. The attack requires a high level of complexity. It is indicated that the exploitability is difficult. The exploit has been published and may be used. Upgrading to version 0.5.5 is able to mitigate this issue. This patch is called ce08eea76ce5898200efee55f4932fd07a7cabeb. It is suggested to upgrade the affected component. A contributor of the project confirms: "hex_hash_to_int16() was introduced in 0.3.1 (PR #882, commit f5174701). It is not present in 0.3.0, and it is still present in 0.4.7 through 0.5.4."
References
Metrics cvssV2_0

{'score': 2.4, 'vector': 'AV:L/AC:H/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.6, 'vector': 'CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.6, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R'}

 cvssV2_0

{'score': 2.4, 'vector': 'AV:L/AC:H/Au:S/C:N/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 3.6, 'vector': 'CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 3.6, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A flaw has been found in LMCache up to 0.4.6. This affects the function hex_hash_to_int16 of the file lmcache/integration/vllm/utils.py of the component KV Cache Handler. Executing a manipulation can lead to use of weak hash. The attack needs to be launched locally. The attack requires a high level of complexity. It is indicated that the exploitability is difficult. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.
Title LMCache KV Cache utils.py hex_hash_to_int16 weak hash
First Time appeared Lmcache
Lmcache lmcache
Weaknesses CWE-327
CWE-328
CPEs cpe:2.3:a:lmcache:lmcache:*:*:*:*:*:*:*:*
Vendors & Products Lmcache
Lmcache lmcache
References
Metrics cvssV2_0

{'score': 2.4, 'vector': 'AV:L/AC:H/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.6, 'vector': 'CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.6, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 2, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-327

    Use of a Broken or Risky Cryptographic Algorithm

  • CWE-328

    Use of Weak Hash

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Oct 17, 2026, 6:18 AM
Reserved
Jun 4, 2026, 5:34 AM

View source JSON

Updated
Jun 4, 2026, 5:28 PM

JSON

Status
Deferred
Published
Jun 4, 2026, 4:16 PM
Modified
Oct 17, 2026, 7:16 AM

View source JSON

No data.

Updated
Oct 17, 2026, 10:45 AM

JSON