Executive brief
GPTCache, a library used to speed up AI applications by caching model responses, is vulnerable to a cache collision flaw. Because the software only looks at the beginning of a file or image to decide if it has seen it before, two different files with the same starting data can be mistaken for each other. This could lead to the system returning incorrect cached information to users or potentially exposing sensitive data from a previous request.
Technical details
A vulnerability exists in GPTCache (up to version 0.1.44) within the Cache Key Handler component, specifically in gptcache/processor/pre.py. The functions get_file_bytes(), get_input_str(), and get_image_question() utilize BufferedReader.peek() to derive cache keys. Because peek() only retrieves the bytes currently available in the internal buffer (typically the first 8192 bytes), two distinct files sharing an identical prefix will generate the same cache key. An attacker with local access could exploit this to cause cache poisoning or unauthorized data disclosure in shared cache environments. A proposed fix involves replacing the peek-based logic with a full SHA-256 hash of the file content and properly resetting the file pointer.
Affected products
- zilliztech GPTCache <= 0.1.44
Timeline
- 2026-05-16: disclosed: Issue reported on GitHub repository
- 2026-06-04: advisory: GHSA and NVD advisories published