AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

LMCacheGHSA-3hh9-752g-5g22

LMCache: 16-bit multimodal hash collision can poison KV cache entries

LMCache

CVE-2026-10813 · Published Jun 4, 2026 · updated Jul 23, 2026

Low3.6
No fix yet
GitHub advisory

A flaw has been found in LMCache up to 0.4.6. This affects the function hex_hash_to_int16 of the file lmcache/integration/vllm/utils.py of the component KV Cache Handler. Executing a manipulation can lead to use of weak hash. The attack needs to be launched locally. The attack requires a high level of complexity. It is indicated that the exploitability is difficult. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.

Affected versions

PackageAffectedFixed in
lmcache
PyPI
<= 0.4.6No fix yet
Details and references

More LMCache advisories

All LMCache