Executive brief
LMCache, a library used to speed up large language model (LLM) processing, contains a flaw in how it handles images and other multimodal data. The system uses a very short identifier to distinguish between different images, which makes it easy for two different images to be treated as the same one. In practice, this could allow an attacker to "poison" the system's memory, causing the AI to provide incorrect answers or accidentally reveal information related to a different user's private images.
Technical details
A vulnerability exists in LMCache's KV Cache Handler, specifically within the `hex_hash_to_int16` function in `lmcache/integration/vllm/utils.py`. The function reduces multimodal identifiers (such as image hashes) to a 16-bit integer by either masking hexadecimal input or taking the first two bytes of a SHA-256 hash. This limited entropy (65,536 possible values) leads to frequent hash collisions. An attacker can exploit these collisions to cause the system to return KV cache entries associated with a different image, leading to cache poisoning and potential cross-user data leakage. While the advisory mentions a local attack vector, the underlying mechanism is reachable via network requests in multimodal deployments. A pull request exists to expand the hash to 64 bits.
Affected products
- LMCache LMCache <= 0.4.6
Timeline
- 2026-04-02: patched: Pull request 2932 submitted to fix the issue by expanding hash entropy.
- 2026-05-16: disclosed: Issue 3301 opened detailing the security impact.
- 2026-06-04: advisory: Published to GitHub Advisory Database and NVD.