Vulnerability · Published Oct 1, 2026 · Assigned by VulnCheck

CVE-2026-103761Mooncake transfer engine through 0.3.13.post1 Memory Exhaustion via Unbounded Notify Queue

High 7.5

In plain English

A high-severity resource allocation without limits in Mooncake from kvcache-ai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 59.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePeerNotify that allows unauthenticated attackers to grow process memory without limit. Attackers can repeatedly send notify frames up to 1 MB to the handshake RPC port, filling the uncapped notifys vector until the out-of-memory killer terminates the engine.

Affected products (as reported)

Vendor	Product	Versions
kvcache-ai	Mooncake	0 – through 0.3.13.post1

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

GitHub Issue #4445 issue-tracking
https://github.com/kvcache-ai/Mooncake/blob/719735896c86b56fabec6cf3e825fb2ea640597a/mooncake-transfer-engine/src/transfer_metadata.cpp#L285-L296 technical-description
https://github.com/kvcache-ai/Mooncake product
VulnCheck Advisory: Mooncake transfer engine through 0.3.13.post1 Memory Exhaustion via Unbounded Notify Queue third-party-advisory