CVE-2026-103761

Summary

The Mooncake transfer engine has a memory exhaustion vulnerability that allows unauthenticated attackers to continuously send notify frames up to 1 MB each, causing unlimited memory growth until the system's OOM killer terminates the process. This creates a denial-of-service condition that can be exploited without any authentication or user interaction.

Exploitability

Exploitation is straightforward with no preconditions required, as attackers can simply send repeated notify frames to the handshake RPC port without authentication.

Blast radius

The vulnerability affects all systems running Mooncake transfer engine versions through 0.3.13.post1, potentially causing widespread service disruption across any networked system using this transfer engine.

Detection

Monitor for excessive memory growth patterns in the Mooncake transfer engine process, particularly when multiple notify frames are received over time, and watch for OOM killer activity in system logs.

Prioritized remediation

Upgrade to version 0.3.14 or later to fix the memory exhaustion vulnerability in TransferMetadata::receivePeerNotify.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.