The vulnerability lies in the _freeze function of the Task Result Cache component of langgraph. By manipulating the default_cache_key argument, an attacker can induce use of a weak hash function, increasing the chance of hash collisions results, potentially allowing a malicious user to replace or invalidate cached data and disrupt application logic. The weakness is classified as CWE‑327 and CWE‑328, indicating compromised cryptographic algorithm and a one‑way hash lacking sufficient collision resistance.

All installations of langgraph version 1.2.4 or earlier are affected. The issue is located in libs/langgraph/langgraph/_internal/_cache.py within the Task Result Cache component. Deployments that rely on the default_cache_key parameter remain vulnerable until an official fix is issued.

The CVSS score of 2.3 signifies low severity, and the EPSS score is below 1%, indicating a very low probability of exploitation. The vulnerability can be exploited remotely, but the attacker must craft inputs that trigger hash collisions, a task that is described as high complexity and difficult. The vulnerability is not listed in the CISA KEV catalog. Under these conditions, the immediate risk to systems remains modest, though the potential for cache manipulation warrants attention and monitoring.