The flaw resides in the hex_hash_to_int16 function of LMCache’s KV Cache Handler, where a 16‑bit hash is derived from hex data. This weak hashing algorithm, identified as CWE‑327 and CWE‑328, allows two distinct inputs to produce the same hash value. An attacker who can craft such collisions could replace or tamper with cache entries, effectively altering cached data or masking audit trails, thereby creating data integrity problems.

LMCache users running versions up to 0.4.6 are affected. The vulnerable component is lmcache/integration/vllm/utils.py within the open‑source LMCache project. The issue is present in all distributions of this version range until a patch is released beyond 0.4.6.

The CVSS score is 2, indicating low overall severity, and EPSS data is not available. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires local execution and is considered difficult, with high complexity. A public exploit has already been published, but the attack vector is limited to environments where an attacker can run code locally against the LMCache service.