{"id":"CVE-2026-103761","published":"2026-10-01T23:16:46.987","lastModified":"2026-10-06T03:16:58.860","description":"Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePeerNotify that allows unauthenticated attackers to grow process memory without limit. Attackers can repeatedly send notify frames up to 1 MB to the handshake RPC port, filling the uncapped notifys vector until the out-of-memory killer terminates the engine.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-770"],"vendors":[],"products":[],"references":[{"url":"https://github.com/kvcache-ai/Mooncake","tags":[]},{"url":"https://github.com/kvcache-ai/Mooncake/blob/719735896c86b56fabec6cf3e825fb2ea640597a/mooncake-transfer-engine/src/transfer_metadata.cpp#L285-L296","tags":[]},{"url":"https://github.com/kvcache-ai/Mooncake/issues/4445","tags":[]},{"url":"https://www.vulncheck.com/advisories/mooncake-transfer-engine-through-0.3.13-post1-memory-exhaustion-via-unbounded-notify-queue","tags":[]},{"url":"https://github.com/kvcache-ai/Mooncake/issues/4445","tags":[]}],"exploitRefs":[{"url":"https://github.com/kvcache-ai/Mooncake","tags":[]},{"url":"https://github.com/kvcache-ai/Mooncake/blob/719735896c86b56fabec6cf3e825fb2ea640597a/mooncake-transfer-engine/src/transfer_metadata.cpp#L285-L296","tags":[]},{"url":"https://github.com/kvcache-ai/Mooncake/issues/4445","tags":[]},{"url":"https://github.com/kvcache-ai/Mooncake/issues/4445","tags":[]}],"hasPoc":true,"ai":{"summary":"The Mooncake transfer engine has a memory exhaustion vulnerability that allows unauthenticated attackers to continuously send notify frames up to 1 MB each, causing unlimited memory growth until the system's OOM killer terminates the process. This creates a denial-of-service condition that can be exploited without any authentication or user interaction.","exploitability":"Exploitation is straightforward with no preconditions required, as attackers can simply send repeated notify frames to the handshake RPC port without authentication.","blast_radius":"The vulnerability affects all systems running Mooncake transfer engine versions through 0.3.13.post1, potentially causing widespread service disruption across any networked system using this transfer engine.","remediation":"Upgrade to version 0.3.14 or later to fix the memory exhaustion vulnerability in TransferMetadata::receivePeerNotify.","detection":"Monitor for excessive memory growth patterns in the Mooncake transfer engine process, particularly when multiple notify frames are received over time, and watch for OOM killer activity in system logs.","tags":["denial-of-service","memory-exhaustion","network-service"],"model":"garnet-coder","analyzedAt":"2026-10-12T09:05:13.510Z"}}