Mooncake Transfer Engine EUVD-2026-91135

Exploitation requires only network access to the Mooncake transfer engine's handshake RPC port; the attacker sends notify frames (up to 1 MB each) that are appended to the unbounded notifys vector in TransferMetadata::receivePeerNotify. No authentication is required (PR:N) and no user interaction or special configuration is needed - any default deployment that exposes the handshake RPC port is vulnerable. The practical limiting factor is network exposure of that RPC port: deployments where the port is bound to localhost or restricted to a trusted cluster network by firewalling/segmentation are not reachable by external attackers, which is the primary realistic mitigation until an upstream fix (bounding the notifys vector) is applied.

All available signals converge on a genuine but bounded availability risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a trivially reachable, remote, unauthenticated attack requiring no user interaction or special conditions, and the impact profile is purely availability (VC:N/VI:N/VA:H) consistent with CWE-770 uncontrolled resource consumption - there is no confidentiality or integrity exposure. The score of 8.7 (High) is driven entirely by the ease of triggering a reliable denial of service, not by any code-execution or data-compromise potential, so this should be triaged as a service-availability issue rather than a system-compromise one. No EPSS score, CISA KEV listing, or public POC was supplied in the input, so there is no evidence of active exploitation or weaponization; the vulnerability is realistically exploitable (the mechanism is simple and well-documented by VulnCheck with a direct source-line reference) but not confirmed as being exploited in the wild. The main mitigating factor on real-world priority is deployment footprint: Mooncake is specialized LLM-serving infrastructure, so this is a real priority specifically for organizations running Mooncake-based inference, and comparatively low-urgency for everyone else.

An attacker with network reachability to a Mooncake transfer engine's handshake RPC port repeatedly sends crafted notify frames of up to 1 MB each, with no authentication required. Because the notifys vector in TransferMetadata::receivePeerNotify is uncapped, each frame permanently grows process memory until the Linux OOM killer terminates the engine, taking down the LLM inference service. No public exploit code was identified at time of analysis, but the attack is mechanically simple to reproduce from the public issue and source reference.