CVE-2026-103760

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-01

Last updated on: 2026-10-02

Assigner: VulnCheck

Description

Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated remote attackers to block the handshake daemon by never reading replies. Attackers can send a Metadata request to the handshake RPC port and stall SocketHandShakePlugin's single listener thread in writeFully(), breaking all subsequent handshakes, metadata fetches, notify and probe requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-01

Last Modified

2026-10-02

Generated

2026-10-19

AI Q&A

2026-10-02

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103760

EUVD

EUVD-2026-91134

Affected Vendors & Products

Vendor	Product	Version / Range
kvcache-ai	Mooncake	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial of service issue in the Mooncake transfer engine through version 0.3.13.post1. Unauthenticated remote attackers can exploit it by sending a Metadata request to the handshake RPC port and never reading replies. This stalls the SocketHandShakePlugin's single listener thread in writeFully(), blocking all subsequent handshakes, metadata fetches, notify and probe requests.

Detection Guidance

Detecting this vulnerability involves monitoring for stalled handshake processes or blocked RPC ports. Check for processes named SocketHandShakePlugin or related to the Mooncake transfer engine. Use commands like 'netstat -tuln | grep <handshake_port>' to identify open RPC ports. Monitor system logs for repeated failed handshake attempts or timeouts.

Impact Analysis

This vulnerability can disrupt the availability of the Mooncake transfer engine by preventing legitimate users from establishing handshakes or fetching metadata. It may cause service outages or delays in data transfers, impacting operations relying on this engine.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it is a denial of service issue affecting availability rather than data confidentiality or integrity. However, prolonged downtime could indirectly affect compliance by disrupting services that handle personal or health data.

Mitigation Strategies

Immediately update the Mooncake transfer engine to version 0.3.13.post1 or later. Restrict network access to the handshake RPC port using firewalls. Implement rate limiting on the RPC port to prevent abuse. Monitor for unusual activity and terminate any suspicious connections.

Hi! I’m here to help you understand CVE-2026-103760. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70