CVE-2026-105192
LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport
LMCache is vulnerable to Unauthenticated Remote Code Execution via Pickle Deserialization on the Multiprocess ZMQ Transport
- No known exploitation
- Severity
- Critical, CVSS 9.8 (v3.1)
- EPSS
- 0.48% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- lmcache (pip) >= 0.3.9, < 0.5.6, fixed in 0.5.6 · GHSA-w5f2-9q9c-ff4h