CVE-2026-104433: Kvcache-Ai Mooncake

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated attackers to crash the service by sending a zero-length handshake frame. Attackers can connect to the handshake port listening on all interfaces and send an eight-byte frame to terminate the hosting process, such as an SGLang inference server.

Affected products

• Kvcache-Ai Mooncake: before 0.3.12 (fixed in 0.3.12)

Published 2026-10-03. Last modified 2026-10-06.