Denial of Service Vulnerability in Mooncake Transfer Engine by KVCACHE
CVE-2026-103760

8.2HIGH

Key Information:

Vendor

Kvcache-ai

Status
Mooncake
Vendor
CVE Published:
1 October 2026

What is CVE-2026-103760?

The Mooncake transfer engine, specifically versions prior to 0.3.13.post1, exposes a Denial of Service vulnerability that allows unauthenticated remote attackers to stall the handshake daemon. By persistently sending Metadata requests to the handshake RPC port, attackers can effectively block the SocketHandShakePlugin's listener thread. This disruption not only halts handshakes but also prevents metadata fetches, notifications, and probe requests from being processed. Consequently, the vulnerability impacts the overall availability of the affected services, making remediation crucial.

Affected Version(s)

Mooncake 0 <= 0.3.13.post1

References

https://github.com/kvcache-ai/Mooncake/issues/4443
issue-tracking
https://github.com/kvcache-ai/Mooncake/blob/719735896c86b...
technical-description
https://github.com/kvcache-ai/Mooncake
product

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mingkai Yu
Jiajia Liu
.