CVE-2026-103761

{
  "etk_id": "ETK-2026-289",
  "cve_id": "CVE-2026-103761",
  "display_id": "CVE-2026-103761",
  "ghsa_id": "GHSA-62mv-x7jm-w9f4",
  "euvd_id": "EUVD-2026-91135",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unbounded memory consumption in Mooncake transfer engine",
  "summary": "Mooncake transfer engine versions through 0.3.13.post1 are affected by unbounded memory consumption while handling handshake notifications. An unauthenticated attacker can exhaust engine memory and cause termination if they can reach the handshake RPC port.",
  "mitigation": "Restrict network access to the handshake RPC port to trusted peers and apply connection or request-rate controls where available. Monitor affected engines for abnormal memory growth until an upstream fixed release is available.",
  "vendor": "kvcache-ai",
  "product": "Mooncake",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 0.3.13.post1"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Mooncake",
      "purl": null
    }
  ],
  "cwes": [
    770
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0037,
  "epss_percentile": 0.2904,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 69.3218026,
  "t0_at": "2026-10-01T22:53:06.016000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-01T22:53:06.016000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-01T22:53:06.016000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103761"
    }
  }
}