CVE-2026-96764 - Vulnerability Details

- kvcache-ai mooncake Regular Expression GetReplicaListByRegex allocation of resources

Description

A weakness has been identified in kvcache-ai mooncake up to 0.3.12/0.3.14-rc1. Impacted is the function MasterService::GetReplicaListByRegex of the component Regular Expression Handler. Executing a manipulation can lead to allocation of resources. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Published: 2026-09-24

Score: 5.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw resides in the MasterService::GetReplicaListByRegex function of kvcache-ai mooncake's Regular Expression Handler. An attacker can supply a crafted regular expression that forces the service to allocate an unbounded amount of memory or other resources, potentially exhausting system capacity. The resulting denial of service could affect the availability of the mooncake service and any dependent applications. This vulnerability is a classic example of improper resource management.

Affected Systems

kvcache-ai mooncake versions up to 0.3.12 and 0.3.14-rc1 are impacted. Any deployment of these releases that exposes the GetReplicaListByRegex API to external clients is at risk.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, so the risk of exploitation cannot be quantified, and the vulnerability is not listed in CISA’s KEV catalog. Exploit code is publicly available and can be executed remotely by sending a malicious regex to the service.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

kvcache-ai

mooncake

affected

Version	Status	Constraints
`0.3.0`	affected	—
`0.3.1`	affected	—
`0.3.2`	affected	—
`0.3.3`	affected	—
`0.3.4`	affected	—
`0.3.5`	affected	—
`0.3.6`	affected	—
`0.3.7`	affected	—
`0.3.8`	affected	—
`0.3.9`	affected	—
`0.3.10`	affected	—
`0.3.11`	affected	—
`0.3.12`	affected	—
`0.3.14-rc1`	affected	—

No data.

Vendor Product Confidence Versions

Kvcache-ai

Mooncake

100%

Version	Status	Scheme	Platform
`0.3.0`	affected	semver	—
`0.3.1`	affected	semver	—
`0.3.2`	affected	semver	—
`0.3.3`	affected	semver	—
`0.3.4`	affected	semver	—
`0.3.5`	affected	semver	—
`0.3.6`	affected	semver	—
`0.3.7`	affected	semver	—
`0.3.8`	affected	semver	—
`0.3.9`	affected	semver	—
`0.3.10`	affected	semver	—
`0.3.11`	affected	semver	—
`0.3.12`	affected	semver	—
`0.3.14-rc1`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update kvcache-ai mooncake to a version later than 0.3.12/0.3.14-rc1 that contains the fix
Validate or restrict the size and complexity of regular expressions before they are processed, applying length limits or rejecting overly complex patterns
Configure resource limits (e.g., memory or CPU quotas) for the mooncake service and monitor for abnormal resource usage

Generated by OpenCVE AI on September 24, 2026 at 01:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00271.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://gist.github.com/yyymk/4699cc95ab9a559ee15a0fb798bd6c5d
https://vuldb.com/cve/CVE-2026-96764
https://vuldb.com/submit/904607
https://vuldb.com/vuln/409019
https://vuldb.com/vuln/409019/cti

History

Thu, 24 Sep 2026 00:30:00 +0000

Type	Values Removed	Values Added
Description		A weakness has been identified in kvcache-ai mooncake up to 0.3.12/0.3.14-rc1. Impacted is the function MasterService::GetReplicaListByRegex of the component Regular Expression Handler. Executing a manipulation can lead to allocation of resources. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title		kvcache-ai mooncake Regular Expression GetReplicaListByRegex allocation of resources
First Time appeared		Kvcache-ai Kvcache-ai mooncake
Weaknesses		CWE-400 CWE-770
CPEs		cpe:2.3:a:kvcache-ai:mooncake::::::::
Vendors & Products		Kvcache-ai Kvcache-ai mooncake
References		https://gist.github.com/yyymk/4699cc95ab9a559ee15a0fb798bd6c5d https://vuldb.com/cve/CVE-2026-96764 https://vuldb.com/submit/904607 https://vuldb.com/vuln/409019 https://vuldb.com/vuln/409019/cti
Metrics		cvssV2_0 `{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Kvcache-ai Mooncake

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-09-24T00:15:12.968Z

Updated: 2026-09-24T14:33:28.453Z

Reserved: 2026-09-23T16:01:24.847Z

Link: CVE-2026-96764

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2026-09-24T01:16:59.813

Modified: 2026-09-24T15:18:00.490

Link: CVE-2026-96764

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-24T09:09:03Z

Weaknesses

CWE-400
Uncontrolled Resource Consumption
CWE-770
Allocation of Resources Without Limits or Throttling

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object