CVE-2026-10813: LMCache weak hash collision in KV Cache Handler

CVE-2026-10813 · Severity: low · CVSS 3.6 · Published 2026-06-04

LMCache, a library used to speed up large language model (LLM) processing, contains a flaw in how it handles images and other multimodal data. The system uses a very short identifier to distinguish between different images, which makes it easy for two different images to be treated as the same one. In practice, this could allow an attacker to "poison" the system's memory, causing the AI to provide incorrect answers or accidentally reveal information related to a different user's private images.

Technologies: LMCache, lmcache (PyPI). Vendors: LMCache, PyPI.

Quick answers

Is CVE-2026-10813 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-10813 being exploited in the wild.
How severe is CVE-2026-10813?
Low severity, with a CVSS score of 3.6, published 4 June 2026.
Which products and versions are affected?
LMCache <= 0.4.6, up to 0.4.6; lmcache (PyPI) ECOSYSTEM:introduced=0,last_affected=0.4.6.
Is there a fix for CVE-2026-10813?
A patch was published on 2026-04-02: Pull request 2932 submitted to fix the issue by expanding hash entropy. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-10813 attacked?
It is attacked over the network or with local access, in a software library.
Am I affected by CVE-2026-10813?
Check whether you run LMCache or lmcache (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in LMCache's KV Cache Handler, specifically within the `hex_hash_to_int16` function in `lmcache/integration/vllm/utils.py`. The function reduces multimodal identifiers (such as image hashes) to a 16-bit integer by either masking hexadecimal input or taking the first two bytes of a SHA-256 hash. This limited entropy (65,536 possible values) leads to frequent hash collisions. An attacker can exploit these collisions to cause the system to return KV cache entries associated with a different image, leading to cache poisoning and potential cross-user data leakage. While the advisory mentions a local attack vector, the underlying mechanism is reachable via network requests in multimodal deployments. A pull request exists to expand the hash to 64 bits.

Affected products

  • LMCache LMCache <= 0.4.6

Identifiers

  • CVE-2026-10813
  • GHSA-3hh9-752g-5g22
  • PYSEC-2026-3480

Timeline

  • 2026-04-02: patched: Pull request 2932 submitted to fix the issue by expanding hash entropy.
  • 2026-05-16: disclosed: Issue 3301 opened detailing the security impact.
  • 2026-06-04: advisory: Published to GitHub Advisory Database and NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.