GHSA-w5f2-9q9c-ff4h: LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport
LMCache is vulnerable to Unauthenticated Remote Code Execution via Pickle Deserialization on the Multiprocess ZMQ Transport
References
- blog.lmcache.ai/en/2026/10/13/an-update-on-cve-2026-105192
- github.com/LMCache/LMCache/blob/v0.3.9/lmcache/v1/multiprocess/custom_types.py
- github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/platform/base/ipc_wrapper.py
- github.com/LMCache/LMCache/commit/160b6dec469edb765efd1fad42aca5a438b08bb5
- github.com/LMCache/LMCache/commit/62f74c417dfe1ba56761733fd25dc8209a192f20
- github.com/LMCache/LMCache/commit/767c7e367bbdc357c445cf7bd2ed259cff8d5865
- github.com/LMCache/LMCache/pull/5644
- github.com/LMCache/LMCache/pull/5684
- github.com/LMCache/LMCache/pull/5685
- github.com/LMCache/LMCache/security/advisories/GHSA-w5f2-9q9c-ff4h
- github.com/advisories/GHSA-w5f2-9q9c-ff4h
- nvd.nist.gov/vuln/detail/CVE-2026-105192
- research.jfrog.com/vulnerabilities/lmcache-is-vulnerable-to-unauthenticated-remote-code-execution-via-pickle-deserialization-on-the-multiprocess-zmq-transport-cve-2026-105192-jfsa-2026-001694382
Code Behaviors & Features
Detect and mitigate GHSA-w5f2-9q9c-ff4h with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →