Vulnerability GHSA-3hh9-752g-5g22
Low Risk
LOW RISK
CVSS Score: 3.6
Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
4 months ago
June 04, 2026 at 06:30 PM UTC
LMCache: 16-bit multimodal hash collision can poison KV cache entries
0.3.0 - 0.4.6
0.3.0 - 0.4.6
Summary
LMCache: 16-bit multimodal hash collision can poison KV cache entries
Details
A flaw has been found in LMCache up to 0.4.6. This affects the function hex_hash_to_int16 of the file lmcache/integration/vllm/utils.py of the component KV Cache Handler. Executing a manipulation can lead to use of weak hash. The attack needs to be launched locally. The attack requires a high level of complexity. It is indicated that the exploitability is difficult. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Critical
4 hours ago
LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport
0.3.9 - 0.5.6rc5 GHSA-w5f2-9q9c-ff4h
0.3.9 - 0.5.6rc5 GHSA-w5f2-9q9c-ff4h
Low Risk
2 months ago
LMCache: 16-bit multimodal hash collision can poison KV cache entries
0.3.0 - 0.4.6 PYSEC-2026-3480
0.3.0 - 0.4.6 PYSEC-2026-3480
Impacted packages
Timeline
Published
4 months ago
June 04, 2026 at 06:30 PM UTC
Last Modified
2 months ago
July 23, 2026 at 03:11 PM UTC