CVE-2026-103761: Memory Exhaustion in Mooncake Transfer Engine

• •CVE-2026-103761 allows unauthenticated memory exhaustion attacks on Mooncake transfer engine.
• •Attackers can exploit the vulnerability by sending large crafted notify frames to the handshake RPC port.
• •High operational risk due to potential service disruption, but no confirmed exploitation or PoC available.

A memory exhaustion vulnerability (CVE-2026-103761) has been identified in the Mooncake transfer engine through version 0.3.13.post1. This flaw allows unauthenticated attackers to exploit the TransferMetadata::receivePeerNotify function, leading to uncontrolled memory growth. Attackers can send crafted notify frames up to 1 MB to the handshake RPC port, potentially causing the out-of-memory killer to terminate the engine. The risk is assessed as high, affecting deployments with accessible handshake ports from untrusted networks. Successful exploitation can disrupt data transfer services and degrade dependent workloads. No immediate proof-of-concept or has been reported, and the urgency for patching remains uncertain due to the absence of KEV, SSVC, and EPSS indicators. Affected operators are advised to monitor memory usage and restrict access to the handshake port until a fix is applied.