Mooncake
Monthly
Unauthenticated access to Mooncake's HTTP metadata server (all versions through 0.3.13.post1) lets any network-reachable party read, overwrite, or delete transfer-engine metadata keys, allowing segment descriptors such as tcp_data_port to be poisoned or rpc_meta entries to be recreated so that KV cache transfers are redirected to attacker-controlled listeners, or server memory is exhausted. The flaw is a missing-authentication defect (CWE-306) on the /metadata handler and carries a CVSS 4.0 base score of 8.8 (assessed equivalently as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H), meaning no credentials are required once the server is reachable on the network. Exploitation is therefore limited by network exposure rather than by attacker prerequisites, and no public exploit was identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated attackers with network reachability to the Mooncake transfer engine's TCP transport data port on releases before 0.3.13 can achieve arbitrary process memory read and write by sending a crafted SessionHeader whose addr and size fields are attacker-controlled under a READ or WRITE opcode. Successful exploitation discloses in-memory KV cache contents, prompts and other secrets, and corrupts memory in the transfer engine process, giving a credible route toward further compromise of the served model; the 9.3 score reflects a network-reachable, no-credentials, no-interaction attack with high confidentiality, integrity and availability impact confined to the vulnerable component. No public exploit code has been identified at time of analysis, and the practical limiting factor is exposure of the data port, which is normally bound inside a trusted LLM-serving cluster network - flat, misconfigured or internet-facing deployments carry the highest risk. Vendor-released patches are available in v0.3.13.
Unauthenticated memory exhaustion in the Mooncake transfer engine (all versions through 0.3.13.post1) allows any network client that can reach the handshake RPC port to grow process memory without limit and force the out-of-memory killer to terminate the engine. Attackers simply replay notify frames of up to 1 MB each into TransferMetadata::receivePeerNotify, which appends every notification to an uncapped 'notifys' vector with no size, count, or peer-identity check; the CVSS 4.0 base score of 8.7 reflects uniformly high availability impact (VA:H) with no confidentiality or integrity loss. No authentication, user interaction, or special configuration is required (PR:N, UI:N), so any default deployment that exposes the handshake RPC port to an untrusted network is reachable; no public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV, so this remains a bounded denial-of-service risk whose practical exposure depends almost entirely on whether that RPC port is firewalled or bound to localhost.
Denial of service in Mooncake Transfer Engine through 0.3.13.post1 allows unauthenticated remote attackers to permanently stall the P2P handshake daemon by sending a Metadata request to the handshake RPC port and then never reading the server's reply, which blocks the single listener thread inside writeFully(). This prevents all subsequent handshakes, metadata fetches, notify, and probe operations, causing an availability loss only (no code execution or data compromise). No public exploit identified at time of analysis; exploitation requires network reachability to the exposed handshake RPC port, and deployments that bind it to a trusted internal network or loopback are not remotely exploitable. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) and independent assessment agree the stall depends on hitting the blocking-write state, so it is a genuine but not automatic denial of service.
Uncontrolled resource allocation in the MasterService::GetReplicaListByRegex handler of kvcache-ai Mooncake (all versions up to and including 0.3.12, and 0.3.14-rc1) allows a remote low-privilege client that can reach the MasterService RPC endpoint to exhaust server memory or CPU by submitting a crafted regular expression to the Regular Expression Handler. The impact is availability-only and partial (CVSS 4.0 5.3, VA:L; assessed CVSS 3.1 5.3 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), so this is a denial-of-service concern rather than a confidentiality or integrity compromise. Publicly available exploit code exists (a proof-of-concept gist is referenced via VulDB), and the affected project has a small deployment footprint; no CISA KEV entry exists and no vendor patch was released because the vendor did not respond to the disclosure.
Improper access control in kvcache-ai Mooncake up to versions 0.3.12, 0.3.13.post1, and 0.3.14-rc1 allows remote attackers to manipulate the ScopedSegmentAccess::MountSegment routine in segment.cpp so that a client can mount segments outside its intended scope, degrading the integrity and availability of segment state. Per the CVSS vector (PR:N) the attack requires no authentication, and impact is bounded to low integrity and availability loss with no confidentiality exposure and no code execution. Publicly available exploit code exists (a public gist is cited in the disclosure), and because the vendor was contacted early but did not respond, no vendor-released patch has been identified at time of analysis.
Unauthenticated access to Mooncake's HTTP metadata server (all versions through 0.3.13.post1) lets any network-reachable party read, overwrite, or delete transfer-engine metadata keys, allowing segment descriptors such as tcp_data_port to be poisoned or rpc_meta entries to be recreated so that KV cache transfers are redirected to attacker-controlled listeners, or server memory is exhausted. The flaw is a missing-authentication defect (CWE-306) on the /metadata handler and carries a CVSS 4.0 base score of 8.8 (assessed equivalently as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H), meaning no credentials are required once the server is reachable on the network. Exploitation is therefore limited by network exposure rather than by attacker prerequisites, and no public exploit was identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated attackers with network reachability to the Mooncake transfer engine's TCP transport data port on releases before 0.3.13 can achieve arbitrary process memory read and write by sending a crafted SessionHeader whose addr and size fields are attacker-controlled under a READ or WRITE opcode. Successful exploitation discloses in-memory KV cache contents, prompts and other secrets, and corrupts memory in the transfer engine process, giving a credible route toward further compromise of the served model; the 9.3 score reflects a network-reachable, no-credentials, no-interaction attack with high confidentiality, integrity and availability impact confined to the vulnerable component. No public exploit code has been identified at time of analysis, and the practical limiting factor is exposure of the data port, which is normally bound inside a trusted LLM-serving cluster network - flat, misconfigured or internet-facing deployments carry the highest risk. Vendor-released patches are available in v0.3.13.
Unauthenticated memory exhaustion in the Mooncake transfer engine (all versions through 0.3.13.post1) allows any network client that can reach the handshake RPC port to grow process memory without limit and force the out-of-memory killer to terminate the engine. Attackers simply replay notify frames of up to 1 MB each into TransferMetadata::receivePeerNotify, which appends every notification to an uncapped 'notifys' vector with no size, count, or peer-identity check; the CVSS 4.0 base score of 8.7 reflects uniformly high availability impact (VA:H) with no confidentiality or integrity loss. No authentication, user interaction, or special configuration is required (PR:N, UI:N), so any default deployment that exposes the handshake RPC port to an untrusted network is reachable; no public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV, so this remains a bounded denial-of-service risk whose practical exposure depends almost entirely on whether that RPC port is firewalled or bound to localhost.
Denial of service in Mooncake Transfer Engine through 0.3.13.post1 allows unauthenticated remote attackers to permanently stall the P2P handshake daemon by sending a Metadata request to the handshake RPC port and then never reading the server's reply, which blocks the single listener thread inside writeFully(). This prevents all subsequent handshakes, metadata fetches, notify, and probe operations, causing an availability loss only (no code execution or data compromise). No public exploit identified at time of analysis; exploitation requires network reachability to the exposed handshake RPC port, and deployments that bind it to a trusted internal network or loopback are not remotely exploitable. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) and independent assessment agree the stall depends on hitting the blocking-write state, so it is a genuine but not automatic denial of service.
Uncontrolled resource allocation in the MasterService::GetReplicaListByRegex handler of kvcache-ai Mooncake (all versions up to and including 0.3.12, and 0.3.14-rc1) allows a remote low-privilege client that can reach the MasterService RPC endpoint to exhaust server memory or CPU by submitting a crafted regular expression to the Regular Expression Handler. The impact is availability-only and partial (CVSS 4.0 5.3, VA:L; assessed CVSS 3.1 5.3 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), so this is a denial-of-service concern rather than a confidentiality or integrity compromise. Publicly available exploit code exists (a proof-of-concept gist is referenced via VulDB), and the affected project has a small deployment footprint; no CISA KEV entry exists and no vendor patch was released because the vendor did not respond to the disclosure.
Improper access control in kvcache-ai Mooncake up to versions 0.3.12, 0.3.13.post1, and 0.3.14-rc1 allows remote attackers to manipulate the ScopedSegmentAccess::MountSegment routine in segment.cpp so that a client can mount segments outside its intended scope, degrading the integrity and availability of segment state. Per the CVSS vector (PR:N) the attack requires no authentication, and impact is bounded to low integrity and availability loss with no confidentiality exposure and no code execution. Publicly available exploit code exists (a public gist is cited in the disclosure), and because the vendor was contacted early but did not respond, no vendor-released patch has been identified at time of analysis.