Description
Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePeerNotify that allows unauthenticated attackers to grow process memory without limit. Attackers can repeatedly send notify frames up to 1 MB to the handshake RPC port, filling the uncapped notifys vector until the out-of-memory killer terminates the engine.
Published: 2026-10-01
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: Denial of Service via Memory Exhaustion
Action: Immediate Patch
AI Analysis

Impact

Mooncake transfer engine contains a memory exhaustion flaw in TransferMetadata::receivePeerNotify. Unauthenticated attackers can send arbitrarily large notify frames—up to 1 MB—to the handshake RPC port, causing the internal notify queue vector to grow unchecked. The resulting out‑of‑memory conditions trigger the kernel’s OOM killer, terminating the engine and disrupting service continuity.

Affected Systems

The vulnerability affects kvcache-ai's Mooncake transfer engine, all releases up to and including version 0.3.13.post1. Earlier releases are also susceptible as the flaw is present through this point in the codebase.

Risk and Exploitability

With a CVSS score of 8.7 the flaw is considered high severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Attackers only need unauthenticated network access to the handshake RPC port and can repeatedly issue notify requests; no privileged state or local access is required. The primary risk is that sustained exploitation will force the process to terminate, causing a denial of service for users of the transfer engine.

Generated by OpenCVE AI on October 2, 2026 at 00:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Consult the vendor for a patched Mooncake release that resolves the unbounded notify queue issue and apply the update promptly.
  • Implement input validation on the notify frames to enforce a maximum size threshold, preventing unbounded memory growth within the transfer engine.
  • Restrict external traffic to the handshake RPC port using firewalls or network segmentation, allowing connections only from trusted sources.
  • Monitor the memory usage of the Mooncake transfer engine; configure alerts to trigger when usage approaches critical limits so operational staff can respond before the OOM killer is invoked.

Generated by OpenCVE AI on October 2, 2026 at 00:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 02 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Kvcache-ai
Kvcache-ai mooncake
Vendors & Products Kvcache-ai
Kvcache-ai mooncake

Thu, 01 Oct 2026 23:00:00 +0000

Type Values Removed Values Added
Description Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePeerNotify that allows unauthenticated attackers to grow process memory without limit. Attackers can repeatedly send notify frames up to 1 MB to the handshake RPC port, filling the uncapped notifys vector until the out-of-memory killer terminates the engine.
Title Mooncake transfer engine through 0.3.13.post1 Memory Exhaustion via Unbounded Notify Queue
Weaknesses CWE-770
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Kvcache-ai Mooncake
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-01T22:53:06.016Z

Reserved: 2026-10-01T10:39:47.845Z

Link: CVE-2026-103761

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-01T23:16:46.987

Modified: 2026-10-01T23:16:46.987

Link: CVE-2026-103761

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-02T00:30:16Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling