PT-2026-104455

CVE-2026-104433

Published

2026-10-02

Updated

2026-10-06

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Mooncake transfer engine versions prior to 0.3.12

Description An out-of-bounds read occurs in the readString() function within include/common.h. This allows unauthenticated attackers to crash the service, such as an SGLang inference server, by connecting to the handshake port and sending a zero-length handshake frame consisting of eight bytes.

Recommendations Update Mooncake transfer engine to version 0.3.12 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Jiajia Liu

Mingkai Yu

Xiangjun Sun

Vendors

Affected products

Weakness enumeration