CVE-2026-104433
Mooncake before 0.3.12 Out-of-Bounds Read via P2P Handshake readString
kvcache-ai Mooncake
CVSS
8.7HighExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 5 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.37%Chance of exploitation activity in the next 30 days, higher than 29% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 0.3.12MooncakeCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated attackers to crash the service by sending a zero-length handshake frame. Attackers can connect to the handshake port listening on all interfaces and send an eight-byte frame to terminate the hosting process, such as an SGLang inference server.
Text from CVE List
Affected versions 2
- Mooncakeaffected: all versions before 0.3.12CVE List
- Mooncakeunaffected: 0.3.12CVE List
References 4
- github.com/kvcache-ai/Mooncake/commit/c142b40590259360196d8e504b2193382529e7b4Fixvia CVE List
- vulncheck.com/advisories/mooncake-before-0.3.12-out-of-bounds-read-via-p2p-handshake-readstringAdvisoryvia CVE List
- github.com/kvcache-ai/Mooncake/issues/4452Exploitvia CVE List
- github.com/kvcache-ai/MooncakeReferencevia CVE List