EUVD-2026-34290
GHSA-3hh9-752g-5g22
Severity by source
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in LMCache up to 0.4.6. This affects the function hex_hash_to_int16 of the file lmcache/integration/vllm/utils.py of the component KV Cache Handler. Executing a manipulation can lead to use of weak hash. The attack needs to be launched locally. The attack requires a high level of complexity. It is indicated that the exploitability is difficult. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.
AnalysisAI
Weak hash truncation in LMCache up to 0.4.6 allows a local low-privilege attacker to induce KV cache collisions by exploiting the severely constrained 16-bit integer output of hex_hash_to_int16 in the vLLM integration's KV Cache Handler. The function masks multimodal content hash identifiers to at most 65,536 unique values, making engineered collisions feasible and causing incorrect cached KV entries to be served, affecting both cache integrity and availability. A proof-of-concept has been published on GitHub (issue #3301); no public exploit confirmed in active exploitation and no CISA KEV listing exists.
Technical ContextAI
LMCache is a KV cache layer for the vLLM LLM inference engine, used to cache key-value data for multimodal content (images and other non-text inputs) identified by hex hash strings such as 'chatcmpl-a2a48871c4aad192-image-0'. The vulnerable function hex_hash_to_int16 in lmcache/integration/vllm/utils.py converts these identifiers to integers by masking the parsed value to 16 bits (0xFFFF maximum), reducing the entire hash space to only 65,536 possible values. CWE-328 (Use of Weak Hash) applies because this truncation is not a collision-resistant operation - it destroys entropy present in the original identifier, making hash collisions statistically inevitable in large multimodal working sets. The PR diff (PR #2932) confirms the fix introduces hex_hash_to_int64, which uses a signed-int64-safe range (up to 0x7FFFFFFFFFFFFFFF), and a new collision test validates zero collisions across 10,000 distinct inputs. The CPE cpe:2.3:a:n/a:lmcache:*:*:*:*:*:*:*:* reflects that NVD has not yet formally attributed a vendor entry for this package.
RemediationAI
The upstream fix is available as GitHub pull request #2932 (https://github.com/LMCache/LMCache/pull/2932), which replaces hex_hash_to_int16 with hex_hash_to_int64 using a signed-int64-safe integer range and retains hex_hash_to_int16 as a deprecated backward-compatible alias. This PR was awaiting acceptance at time of analysis - no patched tagged release version is independently confirmed from a vendor advisory. Organizations requiring immediate remediation can manually apply the PR diff or pin their installation to the post-merge commit once the PR is accepted. As a compensating control before the patch is released, restrict local system access to only trusted operators who need LMCache process access, and limit multimodal input sources to trusted pipelines to reduce the ability to submit crafted colliding identifiers. Note that manually patching from an unmerged PR introduces maintenance overhead and may conflict with future upstream releases; monitor PR #2932 for merge status.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-328 – Use of Weak Hash
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today