Mooncake Transfer Engine Through 0.3.13 Post1 Memory Exhaustion Via Unbounded Notify Queue

Back www.vulncheck.com

Mooncake Transfer Engine Through 0.3.13 Post1 Memory Exhaustion Via Unbounded Notify Queue

www.vulncheck.com • October 2, 2026

Share: View original

Mooncake transfer engine through 0.3.13.post1 Memory Exhaustion via Unbounded Notify Queue

Mooncake <= 0.3.13.post1

Mooncake <= 0.3.13.post1

CWE-770 Allocation of Resources Without Limits or Throttling

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Memory Vulnerabilities in Mooncake Transfer Engine Disclosed On October 1, 2026, multiple critical vulnerabilities were disclosed in the Mooncake transfer engine, particularly CVE-2026-103764 and CVE-2026-103761. CVE-2026-103764, with a CVSS score of 9.3, allows unauthenticated remote attackers to read and write arbitrary memory, potentially leading to code execution. CVE-2026-103761 presents a memory exhaustion vulnerability that can disrupt service by filling memory without limits. Both vulnerabilities affect versions prior to 0.3.13, with patches available for CVE-2026-103764. Attackers can exploit these vulnerabilities via the TCP transport data port and the handshake RPC port, respectively. The urgency of exploitation for CVE-2026-103761 remains uncertain due to the absence of public proof-of-concept or confirmed exploitation. Security professionals are advised to apply patches immediately and restrict network access to vulnerable ports. 2 sources 73

Extracted Entities

CWE Weaknesses (1)

CWE-770 - Allocation of Resources Without Limits or Throttling