CVE-2026-10813

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-10813
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10813.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-10813
Aliases
Downstream
MINI (2)
Published
2026-06-04T14:45:10Z
Modified
2026-10-28T02:30:28Z
Severity
  • 1.1 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
LMCache KV Cache utils.py hex_hash_to_int16 weak hash
Details

A flaw has been found in LMCache up to 0.5.4. This affects the function hex_hash_to_int16 of the file lmcache/integration/vllm/utils.py of the component KV Cache Handler. Executing a manipulation can lead to use of weak hash. The attack needs to be launched locally. The attack requires a high level of complexity. It is indicated that the exploitability is difficult. The exploit has been published and may be used. Upgrading to version 0.5.5 is able to mitigate this issue. This patch is called ce08eea76ce5898200efee55f4932fd07a7cabeb. It is suggested to upgrade the affected component. A contributor of the project confirms: "hex_hash_to_int16() was introduced in 0.3.1 (PR #882, commit f5174701). It is not present in 0.3.0, and it is still present in 0.4.7 through 0.5.4."

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-327",
        "CWE-328"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10813.json"
}
References

Affected packages

Git / github.com/lmcache/lmcache

Affected ranges

Type
GIT
Repo
https://github.com/lmcache/lmcache
Events
Introduced
389b9cfcb5cec502dbba6b5d13725bf2e024610d
Fixed
ce08eea76ce5898200efee55f4932fd07a7cabeb
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0.5.0"
                },
                {
                    "last_affected": "0.5.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.5.1"
                },
                {
                    "last_affected": "0.5.1"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.5.2"
                },
                {
                    "last_affected": "0.5.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.5.3"
                },
                {
                    "last_affected": "0.5.3"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.5.4"
                },
                {
                    "last_affected": "0.5.4"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "fixed": "ce08eea76ce5898200efee55f4932fd07a7cabeb"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

0.*
0.5.0
0.5.1
0.5.2
0.5.3
0.5.4
Other
nightly
nightly-cu129
nightly-musa
nightly-rocm
operator-v0.*
operator-v0.5.0
operator-v0.5.0rc1
operator-v0.5.0rc2
operator-v0.5.0rc3
operator-v0.5.1
operator-v0.5.1rc1
operator-v0.5.2
operator-v0.5.3
operator-v0.5.3rc1
operator-v0.5.4
v0.*
v0.5.0
v0.5.0-cu129
v0.5.0rc1
v0.5.0rc1-cu129
v0.5.1
v0.5.1-cu129
v0.5.1rc1
v0.5.1rc1-cu129
v0.5.1rc2
v0.5.1rc2-cu129
v0.5.2
v0.5.2-cu129
v0.5.2rc1
v0.5.2rc1-cu129
v0.5.3
v0.5.3-cu129
v0.5.3-rocm
v0.5.3.rc3
v0.5.3.rc3-rocm
v0.5.3rc1
v0.5.3rc1-cu129
v0.5.3rc1-rocm
v0.5.3rc2
v0.5.3rc2-cu129
v0.5.3rc2-rocm
v0.5.3rc3
v0.5.3rc3-cu129
v0.5.3rc3-rocm
v0.5.3rc4
v0.5.3rc4-cu129
v0.5.3rc4-rocm
v0.5.4
v0.5.4-cu129
v0.5.4rc1
v0.5.4rc1-cu129
v0.5.4rc1-rocm
v0.5.4rc2
v0.5.4rc2-cu129
v0.5.4rc2-rocm
v0.5.4rc3
v0.5.4rc3-cu129
v0.5.4rc4
v0.5.4rc4-cu129
v0.5.4rc4-rocm
v0.5.4rc5
v0.5.4rc5-cu129
v0.5.5rc1
v0.5.5rc1-cu129
v0.5.5rc1-rocm
v0.5.5rc1-xpu
v0.5.5rc2
v0.5.5rc2-cu129
v0.5.5rc2-rocm
v0.5.5rc2-rocm-torch210
v0.5.5rc2-xpu
v0.5.5rc3
v0.5.5rc3-cu129
v0.5.5rc3-rocm
v0.5.5rc3-rocm-torch210
v0.5.5rc3-xpu
v0.5.5rc4
v0.5.5rc4-cu129
v0.5.5rc4-rocm
v0.5.5rc4-rocm-torch210
v0.5.5rc4-xpu
v0.5.5rc5
v0.5.5rc5-cu129
v0.5.5rc5-musa
v0.5.5rc5-rocm
v0.5.5rc5-rocm-torch210
v0.5.5rc5-xpu

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10813.json"