Memory Exhaustion Vulnerability in Mooncake Transfer Engine by KVCACHE

CVE-2026-103761

What is CVE-2026-103761?

The Mooncake Transfer Engine version 0.3.13.post1 has a vulnerability that enables unauthenticated attackers to exploit a memory exhaustion issue through the TransferMetadata::receivePeerNotify function. By sending multiple notify frames, each up to 1 MB, to the handshake RPC port, attackers can fill an unrestricted notifications vector, leading to excessive memory consumption. This could result in the process being terminated by the out-of-memory killer, compromising server stability and availability.

References