High severity7.5NVD Advisory· Published Oct 1, 2026
CVE-2026-103761
CVE-2026-103761
Description
Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePeerNotify that allows unauthenticated attackers to grow process memory without limit. Attackers can repeatedly send notify frames up to 1 MB to the handshake RPC port, filling the uncapped notifys vector until the out-of-memory killer terminates the engine.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <=0.3.13.post1
Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.