---
id: CVE-2026-10813
aliases:
  - GHSA-3hh9-752g-5g22
title: 'LMCache: 16-bit multimodal hash collision can poison KV cache entries'
summary: 'LMCache: 16-bit multimodal hash collision can poison KV cache entries'
severity: low
cvss: 3.6
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L'
vendor: lmcache
product: lmcache
ecosystem: pip
affected:
  - lmcache <= 0.4.6
published: '2026-06-04'
updated: '2026-07-15'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-3hh9-752g-5g22'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-10813'
  - url: 'https://github.com/LMCache/LMCache/issues/3301'
  - url: 'https://github.com/LMCache/LMCache/pull/2932'
  - url: 'https://github.com/LMCache/LMCache'
  - url: 'https://vuldb.com/cve/CVE-2026-10813'
  - url: 'https://vuldb.com/submit/831641'
  - url: 'https://vuldb.com/vuln/368261'
  - url: 'https://vuldb.com/vuln/368261/cti'
tags:
  - osv
  - pip
epss: 0.00075
epssPercentile: 0.00079
ingestedAt: '2026-07-16T18:59:41.428Z'
---

## Overview

A flaw has been found in LMCache up to 0.4.6. This affects the function hex_hash_to_int16 of the file lmcache/integration/vllm/utils.py of the component KV Cache Handler. Executing a manipulation can lead to use of weak hash. The attack needs to be launched locally. The attack requires a high level of complexity. It is indicated that the exploitability is difficult. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.

## Affected packages

- `lmcache <= 0.4.6`

## Remediation

Refer to the advisory for the patched release.