Recommended Free Tools
LMCache’s documented AES-GCM option encrypts serialized cache data in the durable L2 tier, not the L1 host-memory or L0 GPU-memory tiers. Separately, GitHub’s advisory lists LMCache versions through 0.4.6 as affected by CVE-2026-10813 but names no patched version. Operators should verify the release boundary with current maintainer guidance and treat encryption, tenant isolation, and deployment hardening as separate controls.
What does CVE-2026-10813 affect?
GitHub’s 2026 Advisory Database describes a weak-hash issue in lmcache/integration/vllm/utils.py, in the hex_hash_to_int16 function used by the KV Cache Handler. The linked maintainer issue explains that different multimodal image identifiers can reduce to the same 16-bit value, creating a cache-key collision. In that case, a cache lookup may retrieve KV state generated for another image.
This is a cache-key collision issue, not an advisory for general remote code execution or broad cache-data disclosure. The advisory rates it low severity and gives it a CVSS v4 score of 1.1, with a local attack vector and high attack complexity. Those are the advisory’s assessments; they are not an independent exploitability test. The issue author notes that a 16-bit value has 65,536 possible outcomes and describes collisions after a few hundred generated inputs; that is the author’s collision demonstration, not an independently published benchmark.
Which LMCache versions are affected, and what should I install?
The advisory names versions through 0.4.6 as affected and lists “Patched versions: None.” Its linked maintainer issue is closed as not planned. These records do not establish whether a later release contains a fix, whether the report was rejected, or whether another mitigation exists. They also do not justify labeling every later version vulnerable.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
Before upgrading or setting a version boundary for a production fleet, check the release notes and current maintainer guidance for the exact LMCache version you plan to run, or ask the maintainers directly. Do not infer a fix simply because a release is newer than 0.4.6, and do not treat the advisory’s listed range as proof about versions it does not name.
Does LMCache encrypt the KV cache?
The LMCache Team’s technical post of August 19, 2026 describes an aesgcm serde for the L2 path. It encrypts serialized payload bytes stored through an L2 adapter; the post describes it as usable with filesystem, S3, RESP, and other adapters behind the serde wrapper. The documented default is AES-128-GCM, which provides confidentiality and integrity for those stored bytes.
This is at-rest protection for the durable tier, not end-to-end encryption. L0 GPU memory and L1 host RAM remain plaintext. The feature also does not protect against someone who can access the running multiprocess server process.
What does an L2 storage observer still see?
The post says the L2 object name retains cache_salt and a content-derived chunk_hash. A party able to observe that storage metadata can therefore learn tenant identifiers and detect content overlap without decrypting the payload. Encrypting the bytes does not conceal these names.
How does LMCache’s documented key model work?
The documented default HkdfKeyProvider derives keys from a master key read from master_key_path, using cache_salt as a tenant selector. The salt is not itself key material. Because all derived keys come from the same master key, anyone who holds that master key can derive keys for every tenant using it; this is not independent per-tenant key isolation.
The LMCache post describes KMS-backed per-tenant keys and tenant-to-node placement as future work, rather than shipped defaults. It also says key rotation is manual: operators need to use a new master key, invalidate the cache, and refill it. Plan for that cache lifecycle instead of assuming keys rotate automatically.
What configuration does the project show for AES-GCM?
The official post shows this shape for configuring an L2 adapter. Adapt it to the selected backend and deployment; it is not a complete production secret-management policy.
{
"serde": {
"type": "aesgcm",
"key_provider": "hkdf",
"master_key_path": "/etc/lmcache/keys/master",
"aes_bits": 128
}
}The post says the master key can be mounted as a Kubernetes Secret. Restrict access to the secret and the running process according to your deployment’s trust boundaries; a party able to read the master key can derive all tenant keys based on it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Best Value
What are the format and performance details?
The post describes each encrypted chunk as a version byte, a 12-byte random IV, ciphertext, and a 16-byte GCM authentication tag, for a stated fixed framing overhead of 29 bytes per chunk. It says the IV must not repeat for a given key. A wrong key or failed authentication tag results in a cache load miss, followed by refetch or recomputation rather than silently restoring corrupted state.
The same LMCache Team post reports approximately 4–8 GB/s per core for AES-128-GCM on server hardware with AES-NI. This is the vendor post’s estimate, not an independently verified benchmark; actual throughput depends on the hardware and workload.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How should I deploy LMCache safely?
Safe deployment depends on the entire runtime and topology, not just whether L2 payloads are encrypted. The LMCache deployment guide describes a per-node server shared by vLLM pods in Kubernetes, health checks for its HTTP server variant, and networking and IPC requirements. Use a deployment recipe that matches the exact connector, runtime, and compatibility combination you operate.
- Confirm the software boundary. Check the exact LMCache release against current maintainer guidance for CVE-2026-10813; the advisory alone does not identify a patched release.
- Map the data path. Identify whether each cache copy is in L0 GPU memory, L1 host RAM, or the L2 backend. Apply access controls to each tier; the documented AES-GCM option covers L2 payloads only.
- Set the L2 trust boundary. Decide who can access the backend, its snapshots, object names, and the master key. Use backend access policies alongside payload encryption, and account for visible
cache_saltandchunk_hashmetadata. - Validate IPC and networking. The guide’s default multiprocess example uses shared IPC to support CUDA IPC transfers. Isolated IPC can remove dependence on shared
/dev/shmonly when both LMCache and vLLM enable it, and only for a supported connector and runtime configuration. The guide limits this mode to the vLLM MP connector and notes memory-allocation constraints. - Check health and observability. For Kubernetes, the guide recommends the HTTP server variant for liveness and readiness checks through
/healthcheck, and documents logs and Prometheus metrics. Ensure those endpoints and telemetry fit your access-control policy. - Verify compatibility and correctness. Confirm the exact Python, PyTorch, accelerator ABI, connector-loading path, and model or feature recipe. The compatibility documentation says unlisted combinations are unverified until tested; validate behavior on the actual stack before relying on it.
Which deployment choices change the security boundary?
| Choice | Security implication | What to verify |
|---|---|---|
| L0 GPU memory or L1 host RAM | These tiers remain plaintext under the documented AES-GCM feature. | Who can access the GPU, host, and running LMCache process. |
| L2 durable backend | Payload bytes can be protected at rest with the documented serde; object-name metadata remains visible. | Backend permissions, snapshots, key access, and whether the selected adapter is configured with the serde. |
| Shared master key with salt-derived keys | Holders of the master key can derive keys for all tenants using it. | Master-key access scope and the manual invalidation/refill process for rotation. |
| Per-tenant keys and tenant-to-node placement | The LMCache post identifies these as future work, not a shipped default. | Do not assume this isolation exists unless independently provided and verified in your environment. |
| Shared IPC | The deployment guide’s default multiprocess example uses shared IPC for CUDA IPC transfers. | Whether the IPC sharing model is acceptable for the pods and processes on the node. |
| Isolated IPC | Can remove shared /dev/shm dependency only under the guide’s stated compatibility conditions. |
Enable on both LMCache and vLLM; confirm connector support and memory-allocation constraints. |
How do I report a suspected security issue?
LMCache’s SECURITY.md asks people who believe they have found a vulnerability to email lmcacheteam@gmail.com and include helpful details, such as examples or screenshots. The policy does not name an individual contact or promise a response time.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
