Description
A flaw has been found in LMCache up to 0.4.6. This affects the function hex_hash_to_int16 of the file lmcache/integration/vllm/utils.py of the component KV Cache Handler. Executing a manipulation can lead to use of weak hash. The attack needs to be launched locally. The attack requires a high level of complexity. It is indicated that the exploitability is difficult. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.
References (7)
Core 7
Core References
Vdb Entry, Technical Description vdb-entry
technical-description
VDB-368261 | LMCache KV Cache utils.py hex_hash_to_int16 weak hash
https://vuldb.com/vuln/368261
Signature, Permissions Required signature
permissions-required
VDB-368261 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/368261/cti
Third Party Advisory third-party-advisory
CVE-2026-10813 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-10813
Third Party Advisory third-party-advisory
Submit #831641 | LMCache 729ff73 Cache poisoning
https://vuldb.com/submit/831641
Exploit exploit
issue-tracking
https://github.com/LMCache/LMCache/issues/3301
Patch issue-tracking
patch
https://github.com/LMCache/LMCache/pull/2932
Product product
https://github.com/LMCache/LMCache/
Scores
CVSS v3
3.6
EPSS
0.0009
EPSS Percentile
0.7%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-327
CWE-328
Status
published
Products (7)
None/LMCache
0.4.0
None/LMCache
0.4.1
None/LMCache
0.4.2
None/LMCache
0.4.3
None/LMCache
0.4.4
None/LMCache
0.4.5
None/LMCache
0.4.6
Published
Jun 04, 2026
Tracked Since
Jun 04, 2026