PyPI/lmcache CVE-2026-105192: critical 9.8
LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport
Action: Upgrade lmcache to 0.5.6 or later.
pip install lmcache==0.5.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.3.9 | 0.5.6 | - |
Fixed versions
| 0.5.6 |
Sources
- osv: GHSA-w5f2-9q9c-ff4h
- https://github.com/LMCache/LMCache/security/advisories/GHSA-w5f2-9q9c-ff4h
- https://nvd.nist.gov/vuln/detail/CVE-2026-105192
- https://github.com/LMCache/LMCache/pull/5644
- https://github.com/LMCache/LMCache/pull/5684
- https://github.com/LMCache/LMCache/pull/5685
- https://github.com/LMCache/LMCache/commit/160b6dec469edb765efd1fad42aca5a438b08bb5
- https://github.com/LMCache/LMCache/commit/62f74c417dfe1ba56761733fd25dc8209a192f20
- https://github.com/LMCache/LMCache/commit/767c7e367bbdc357c445cf7bd2ed259cff8d5865
- https://blog.lmcache.ai/en/2026/10/13/an-update-on-cve-2026-105192
- https://github.com/LMCache/LMCache
- https://github.com/LMCache/LMCache/blob/v0.3.9/lmcache/v1/multiprocess/custom_types.py
- https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/platform/base/ipc_wrapper.py
- https://research.jfrog.com/vulnerabilities/lmcache-is-vulnerable-to-unauthenticated-remote-code-execution-via-pickle-deserialization-on-the-multiprocess-zmq-transport-cve-2026-105192-jfsa-2026-001694382
CVE-2026-105192 · published · modified · JSON