CVE-2026-103760CWE-400denial-of-service

CVE-2026-103760

Medium · published October 2, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
33.1
In the wild
Unconfirmed
What it is

Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated remote attackers to block the handshake daemon by never reading replies. Attackers can send a Metadata request to the handshake RPC port and stall SocketHandShakePlugin's single listener thread in writeFully(), breaking all subsequent handshakes, metadata fetches, notify and probe requests.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
8.2 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00400 · 33.1th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-10-02T03:16Z
References (5)
https://github.com/kvcache-ai/Mooncake · [email protected]https://github.com/kvcache-ai/Mooncake/blob/719735896c86b56fabec6cf3e825fb2ea640597a/mooncake-transfer-engine/src/transfer_metadata_plugin.cpp#L730-L803 · [email protected]https://github.com/kvcache-ai/Mooncake/issues/4443 · [email protected]https://www.vulncheck.com/advisories/mooncake-transfer-engine-through-0.3.13-post1-denial-of-service-via-p2p-handshake-daemon-response-write · [email protected]https://github.com/kvcache-ai/Mooncake/issues/4443 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 03 OCT 03:41Z
    EPSS moved — → 0%
    epss
  • 01 OCT 22:53Z
    Mooncake transfer engine through 0.3.13.post1 Denial of Service via P2P Handshake Daemon Response Write
    cvelistv5