CVE-2026-10813 json
LMCache KV Cache utils.py hex_hash_to_int16 weak hash
published 2026-06-04 5 mo ago modified 2026-10-17 23 d ago also GHSA-3hh9-752g-5g22 , PYSEC-2026-3480 , EUVD-2026-34290
- cvss
- 3.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 0%
- public exploits
- 0
- none known
Summary
A flaw has been found in LMCache up to 0.5.4. This affects the function hex_hash_to_int16 of the file lmcache/integration/vllm/utils.py of the component KV Cache Handler. Executing a manipulation can lead to use of weak hash. The attack needs to be launched locally. The attack requires a high level of complexity. It is indicated that the exploitability is difficult. The exploit has been published and may be used. Upgrading to version 0.5.5 is able to mitigate this issue. This patch is called ce08eea76ce5898200efee55f4932fd07a7cabeb. It is suggested to upgrade the affected component. A contributor of the project confirms: "hex_hash_to_int16() was introduced in 0.3.1 (PR #882, commit f5174701). It is not present in 0.3.0, and it is still present in 0.4.7 through 0.5.4."
Patch / fix
- n/a LMCache 0.5.5
- github.com/LMCache/LMCache@ce08eea commit
- pypi.org/project/lmcache/0.5.5/ patch
- github.com/LMCache/LMCache#4783 pull request
- github.com/LMCache/LMCache#2932 pull request
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 5 mo ago
Exploit prediction
0.08% chance of exploitation in the next 30 days, higher than 0% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/LMCache/LMCache/issues/3301 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 2.0 | CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P |
| CNA | 3.1 | 3.6 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C |
| CNA | 3.0 | 3.6 | CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C |
| CNA | 2.0 | 2.4 | AV:L/AC:H/Au:S/C:N/I:P/A:P/E:POC/RL:OF/RC:C |
| CNA | 4.0 | 1.1 | CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 3.6 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L |
| CNA | 2.0 | 2.4 | AV:L/AC:H/Au:S/C:N/I:P/A:P |
| OSV | 3.1 | 3.6 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L |
| GitHub | 3.1 | 3.6 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | lmcache | <=0.4.6 |
no fix listed |
Affected products
- n/a LMCache
Classification
References
-
github.com
/LMCache/LMCache/pull/4783
issue-tracking, patch
-
github.com
/LMCache/LMCache/commit/ce08eea76ce5898200efee55f4932fd07a7cabeb
patch
-
pypi.org
/project/lmcache/0.5.5/
patch
-
github.com
/LMCache/LMCache/pull/2932
web
-
github.com
/LMCache/LMCache/issues/3301
exploit, issue-tracking, web
-
vuldb.com
/vuln/368261
vdb-entry, technical-description, web
-
vuldb.com
/vuln/368261/cti
signature, permissions-required, web
-
vuldb.com
/cve/CVE-2026-10813
third-party-advisory, web
-
vuldb.com
/submit/831641
third-party-advisory, web
-
github.com
/LMCache/LMCache/
product
-
nvd.nist.gov
/vuln/detail/CVE-2026-10813
advisory
-
github.com
/LMCache/LMCache
package
-
pypi.org
/project/lmcache
package
-
github.com
/advisories/GHSA-3hh9-752g-5g22
advisory
Sources
- CVE List CVE-2026-10813
- GitHub Advisory GHSA-3hh9-752g-5g22
- NVD CVE-2026-10813
- OSV PYSEC-2026-3480
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.