PT-2026-104056

CVE-2026-103761

Published

2026-10-01

Updated

2026-10-27

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Mooncake transfer engine versions prior to 0.3.14

Description An unauthenticated attacker can cause memory exhaustion by sending repeated notify frames, each up to 1 MB, to the handshake RPC port. This process fills the uncapped notifys vector within the TransferMetadata::receivePeerNotify() function, leading to unlimited process memory growth until the out-of-memory killer terminates the engine.

Recommendations Update Mooncake transfer engine to version 0.3.14 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Jiajia Liu

Mingkai Yu

Vendors

Affected products

Weakness enumeration

CWE-770: Allocation of Resources Without Limits or Throttling