EUVD-2026-91849
GHSA-ccgr-wx5m-4h7g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed handshake port on all interfaces
-
ExploitSend eight-byte zero-length handshake frame
-
ExecutionTrigger out-of-bounds read in readString
-
ImpactCrash hosting inference process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a Mooncake transfer engine instance before 0.3.12 with its P2P handshake socket listening on all interfaces (0.0.0.0) and reachable from the attacker's network segment - the description states the handshake port listens on all interfaces, which is the default-exposed condition. No authentication, credentials, or user interaction are needed (PR:N/UI:N). The limiting factor is pure network reachability to the handshake port: if that port is firewalled or bound only to loopback/trusted interfaces, remote exploitation is prevented. Impact is confined to availability (crash of the hosting process such as an SGLang inference server); there is no code execution or data exposure. |
| Impact | All signals agree this is an unauthenticated, trivially-triggerable remote denial-of-service rather than a data-breach or RCE issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a network-reachable, low-complexity, no-privilege, no-interaction attack, while the impact metrics (VC:N/VI:N/VA:H) scope the damage strictly to availability - the hosting process crashes. The description corroborates this: an eight-byte zero-length handshake frame terminates the process. Note a genuine conflict between the metadata and the vector: the 'Information Disclosure' tag and CWE-125 (out-of-bounds READ) suggest possible data leakage, but the CVSS confidentiality metric is VC:N and the described outcome is a crash, so treat this as a DoS, not an info-leak. No EPSS score, CISA KEV listing, or POC indicator was provided, so there is no evidence of active exploitation or public exploit code - prioritize based on exposure (is the handshake port reachable from untrusted networks?) rather than on observed attacks. A fix is confirmed upstream (commit c142b405, released in 0.3.12), which lowers residual risk for patched deployments. |
| Exploit ScenarioDerived | An attacker with network reachability to a Mooncake transfer engine (e.g., fronting an SGLang inference server) whose handshake port is bound to all interfaces connects to that port and sends a single eight-byte frame declaring a zero-length string. The readString function in include/common.h performs an out-of-bounds read on the empty payload, crashing the entire hosting inference process and denying service to legitimate clients. No authentication, user interaction, or exploit tooling is required; no public POC was indicated in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 03, 2026
Unauthenticated remote denial of service in Mooncake Transfer Engine before 0.3.12 lets any host that can reach the peer-to-peer handshake socket crash the hosting process - including an SGLang inference server - by sending a single eight-byte handshake frame carrying a zero-length string field. The root cause is an out-of-bounds read (CWE-125) in the readString helper in include/common.h, rated 8.7 under CVSS 4.0 and independently assessed as CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N), with impact confined to availability: no code execution, no data disclosure. Exploitation needs nothing more than network reachability to the handshake port, which the advisory states listens on all interfaces by default; there is no public exploit identified at time of analysis, the issue is not in CISA KEV, and the only limiting factor is whether that port is firewalled or bound to loopback/trusted interfaces.
RemediationAI
Upgrade to Mooncake Transfer Engine 0.3.12 or later, which contains the vendor fix; the minimal change is the zero-length guard in readString() delivered by commit c142b40590259360196d8e504b2193382529e7b4 (https://github.com/kvcache-ai/Mooncake/commit/c142b40590259360196d8e504b2193382529e7b4), with the advisory at https://www.vulncheck.com/advisories/mooncake-before-0.3.12-out-of-bounds-read-via-p2p-handshake-readstring and the upstream report at https://github.com/kvcache-ai/Mooncake/issues/4452. If an immediate engine upgrade is not possible, the effective compensating control is reachability removal rather than detection: stop binding the P2P handshake socket to 0.0.0.0 and restrict it to loopback or a single trusted interface, and firewall the handshake port so only known peer nodes can connect - the trade-off is that cross-node transfers and multi-node inference pipelines will fail or require explicit peer allow-listing, and any deployment relying on broad node-to-node connectivity must be re-architected around that allow-list. Where the engine cannot be rebound, segmenting the cluster so the handshake port is unreachable from untrusted networks, and running the serving process under a supervisor that restarts it automatically, will limit the blast radius of a crash-loop DoS but will not prevent the fault from being triggered. If backporting, apply only the length==0 check; note that the same commit also fixes four freeaddrinfo() leaks and a NULL-segment dereference in the metadata plugin, so cherry-picking the single hunk leaves those defects in place, and note further that no patched container image or distro package version was confirmed in the supplied data, so verify the actual Mooncake version at runtime before assuming you are remediated.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Mooncake is a KV-cache/transfer engine used to move data between nodes in distributed LLM serving stacks (it is notably embedded in SGLang inference servers). Its peer-to-peer metadata exchange is implemented by SocketHandShakePlugin in mooncake-transfer-engine/src/transfer_metadata_plugin.cpp, which accepts connections on a handshake port and parses length-prefixed frames through the inline helper readString(int fd) in mooncake-transfer-engine/include/common.h. The parser reads a length field and then consumes that many bytes without validating the degenerate case: a frame whose length is zero drives an out-of-bounds read (CWE-125) instead of returning an empty string, and the resulting memory-safety fault terminates the hosting process. The upstream fix commit c142b40590259360196d8e504b2193382529e7b4 adds an explicit 'if (length == 0)' guard that logs 'readString: zero length from socket' and returns an empty string, plus three unrelated hardening changes in the same commit - a NULL-segment check in TransferEngineImpl::getNotifies/sendNotifyByID returning ERR_METADATA, and four missing freeaddrinfo() calls in SocketHandShakePlugin. Note the scoring divergence: the CVSS 4.0 vector is effectively base-only (all threat, environmental and supplemental metrics are 'X'), so its 8.7 derives purely from AV:N/AC:L/AT:N/PR:N/UI:N with high availability impact, which is consistent with the independent CVSS:3.1 assessment of 7.5 (S:U/C:N/I:N/A:H) - an availability-only remote DoS, not an RCE or information-disclosure primitive, despite the generic 'Buffer Overflow, Information Disclosure' tags applied by the reporting source.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-reachable handshake port with no auth or interaction gives AV:N/AC:L/PR:N/UI:N; a single malformed frame crashes the process for A:H, with no confidentiality or integrity impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated attackers to crash the service by sending a zero-length handshake frame. Attackers can connect to the handshake port listening on all interfaces and send an eight-byte frame to terminate the hosting process, such as an SGLang inference server.
Executive ViewAI
Organizations running Mooncake Transfer Engine, particularly those hosting SGLang inference servers, face a high-severity unauthenticated remote denial-of-service vulnerability (CVE-2026-104433, CVSS 8.7) that allows any network-reachable host to crash the service by sending a single crafted handshake frame. With no vendor patch currently available and the handshake port listening on all interfaces by default, affected systems are at risk of service outages that could disrupt AI inference workloads, impacting availability and potentially causing SLA breaches. Leadership should prioritize immediate network access controls and monitor for vendor remediation.
No vendor-released patch identified at time of analysis; interim mitigations include restricting network access to the handshake port via firewall rules, binding the service to loopback or trusted interfaces, implementing network segmentation, and monitoring for anomalous handshake traffic.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB