Vulnerability · Published Oct 1, 2026 · Assigned by VulnCheck

CVE-2026-103760Mooncake transfer engine through 0.3.13.post1 Denial of Service via P2P Handshake Daemon Response Write

Medium 5.9

In plain English

A medium-severity uncontrolled resource consumption in Mooncake from kvcache-ai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.5%top 56.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated remote attackers to block the handshake daemon by never reading replies. Attackers can send a Metadata request to the handshake RPC port and stall SocketHandShakePlugin's single listener thread in writeFully(), breaking all subsequent handshakes, metadata fetches, notify and probe requests.

Affected products (as reported)

Vendor	Product	Versions
kvcache-ai	Mooncake	0 – through 0.3.13.post1

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References

GitHub Issue #4443 issue-tracking
https://github.com/kvcache-ai/Mooncake/blob/719735896c86b56fabec6cf3e825fb2ea640597a/mooncake-transfer-engine/src/transfer_metadata_plugin.cpp#L730-L803 technical-description
https://github.com/kvcache-ai/Mooncake product
VulnCheck Advisory: Mooncake transfer engine through 0.3.13.post1 Denial of Service via P2P Handshake Daemon Response Write third-party-advisory