## LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport

- 種別: advisory
- 重大度: critical
- 関連技術: python
- CVE: CVE-2026-105192
- 公開日時: 2026-10-16T20:08:44.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-w5f2-9q9c-ff4h)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-w5f2-9q9c-ff4h

影響: pip:lmcache >= 0.3.9, < 0.5.6 → 0.5.6
Summary LMCache is vulnerable to Unauthenticated Remote Code Execution via Pickle Deserialization on the Multiprocess ZMQ Transport Details LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. The intended clients are sibling LMCache processes. There is no CURVE, ZAP, password, or message authentication on that socket. LMCache used only inside a vLLM process does not open this port. The transp…