PyPI/lmcache CVE-2026-10813: low 3.6, EPSS 0.08%

LMCache: 16-bit multimodal hash collision can poison KV cache entries

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: PYSEC-2026-3480
• https://nvd.nist.gov/vuln/detail/CVE-2026-10813
• https://github.com/LMCache/LMCache/issues/3301
• https://github.com/LMCache/LMCache/pull/2932
• https://github.com/LMCache/LMCache
• https://vuldb.com/cve/CVE-2026-10813
• https://vuldb.com/submit/831641
• https://vuldb.com/vuln/368261
• https://vuldb.com/vuln/368261/cti
• https://pypi.org/project/lmcache
• https://github.com/advisories/GHSA-3hh9-752g-5g22

CVE-2026-10813 · published 2026-07-23T11:41:38.726472Z · modified 2026-07-23T15:00:13.750119453Z · JSON