CVE-2026-104433

High

Description

Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated attackers to crash the service by sending a zero-length handshake frame. Attackers can connect to the handshake port listening on all interfaces and send an eight-byte frame to terminate the hosting process, such as an SGLang inference server.

SeverityHigh

CVSS7.5

Exploit probability—

ProductMooncake

PublishedOct 3, 2026

First seenOct 3, 2026

Weakness typeCWE-125Out-of-bounds read

How to fix

Update

kvcache-ai Mooncake0.3.12 or later

Patches

github.com/kvcache-ai/Mooncake/commit/c142b40590259360196d8e504b2193382529e7b4

Affected products

Product	Affected versions	Fixed in
kvcache-ai Mooncake	v < 0.3.12	0.3.12

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.