CVE-2026-104433

Summary

The Mooncake transfer engine has an out-of-bounds read vulnerability in its string parsing function that can be triggered by sending a zero-length handshake frame, allowing unauthenticated attackers to crash the service and potentially disrupt SGLang inference server operations.

Exploitability

Exploitation is straightforward as attackers need only connect to the handshake port and send an eight-byte frame to trigger the crash, requiring no authentication or complex payloads.

Blast radius

The impact could be significant for systems running SGLang inference servers that are exposed to untrusted networks, potentially causing service disruption and denial of service attacks.

Detection

Monitor for unexpected process termination or crash logs from the Mooncake transfer engine, particularly when connections are made to the handshake port on all interfaces.

Prioritized remediation

Upgrade to version 0.3.12 or later which contains the fix for the out-of-bounds read vulnerability in include/common.h.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.