CVE-2026-96764CWE-400CWE-770denial-of-service

CVE-2026-96764

Medium · published September 24, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
18.3
In the wild
Unconfirmed
What it is

A weakness has been identified in kvcache-ai mooncake up to 0.3.12/0.3.14-rc1. Impacted is the function MasterService::GetReplicaListByRegex of the component Regular Expression Handler. Executing a manipulation can lead to allocation of resources. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00271 · 18.3th percentile
Weaknesses
CWE-400 · Uncontrolled Resource Consumption; CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-09-24T05:16Z
References (5)
https://gist.github.com/yyymk/4699cc95ab9a559ee15a0fb798bd6c5d · [email protected]https://vuldb.com/cve/CVE-2026-96764 · [email protected]https://vuldb.com/submit/904607 · [email protected]https://vuldb.com/vuln/409019 · [email protected]https://vuldb.com/vuln/409019/cti · [email protected]
EPSS history
Timeline
  • 25 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 24 SEP 00:15Z
    kvcache-ai mooncake Regular Expression GetReplicaListByRegex allocation of resources
    cvelistv5