Mooncake Transfer Engine: Memory exhaustion via unbounded notify queue
Summary
The Mooncake transfer engine up to version 0.3.13.post1 does not limit the number of pending peer notify messages in TransferMetadata::receivePeerNotify. An unauthenticated attacker with network access to the handshake RPC port can send repeated notify frames of up to 1 MB each, so process memory grows until the out-of-memory killer terminates the engine. The impact is limited to availability (denial of service). A public proof of concept is referenced in the upstream issue.
Affected
- kvcache-ai Mooncake transfer engine, versions 0 to 0.3.13.post1 (inclusive)
- Package mooncake-transfer-engine (PyPI)
Fixed in
- Unknown. A fix (pull request #4453, capping the pending-notify queue) is merged on the main branch, but no released fixed version was found at the time of writing.
Workaround
- Restrict network access to the handshake RPC port (documented range 15000–17000) to the deployment's own hosts using firewall rules or network segmentation.
- Pin the Mooncake version in dependency files to prevent unintended installation of vulnerable releases.
- Rate limiting is a temporary measure only and may not prevent memory exhaustion.
Exploitation
- Public proof of concept: yes, included in the upstream GitHub issue #4445.
- CISA SSVC: exploitation status poc, automatable yes, technical impact partial.
- Known exploited (CISA KEV): not known.
- EPSS: 0.00366.
Our recommendation
- Check whether Mooncake is deployed in your environment, for example through Python dependencies, container images or AI/LLM serving tools.
- If it is present, restrict access to the handshake RPC port immediately.
- Monitor process memory growth, OOM-killer events and unexpected engine restarts.
- Track the first Mooncake release that includes the fix from PR #4453 and upgrade promptly.
- Priority: low to medium for most SMEs; high for organisations running Mooncake in shared clusters or exposed networks.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Mooncake GitHub repository github.com
- Affected source code (transfer_metadata.cpp) github.com
- Mooncake issue #4445 github.com
- VulnCheck advisory www.vulncheck.com
- Mooncake pull request #4453 (fix) github.com
- Mooncake issue #4626 github.com
- mstar issue #466 github.com
- VulnRichment (CVSS, EPSS) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:15.
Original description (NVD)
Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePeerNotify that allows unauthenticated attackers to grow process memory without limit. Attackers can repeatedly send notify frames up to 1 MB to the handshake RPC port, filling the uncapped notifys vector until the out-of-memory killer terminates the engine.
NVD references (5)
- https://github.com/kvcache-ai/Mooncake
- https://github.com/kvcache-ai/Mooncake/blob/719735896c86b56fabec6cf3e825fb2ea640597a/mooncake-transfer-engine…
- https://github.com/kvcache-ai/Mooncake/issues/4445
- https://www.vulncheck.com/advisories/mooncake-transfer-engine-through-0.3.13-post1-memory-exhaustion-via-unbo…
- https://github.com/kvcache-ai/Mooncake/issues/4445
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.