CVE-2026-103761

Name of the Vulnerable Software and Affected Versions Mooncake transfer engine versions prior to 0.3.14

Description An unauthenticated attacker can cause memory exhaustion by sending repeated notify frames, each up to 1 MB, to the handshake RPC port. This process fills the uncapped notifys vector within the TransferMetadata::receivePeerNotify() function, leading to unlimited process memory growth until the out-of-memory killer terminates the engine.

Recommendations Update Mooncake transfer engine to version 0.3.14 or later.