CVE-2026-104433 Mooncake before 0.3.12 Out-of-Bounds Read via P2P Handshake readString
Unauthenticated attackers can crash the Mooncake transfer engine by sending a zero-length handshake frame, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-104433?
CVE-2026-104433 is a high-severity denial of service vulnerability in kvcache-ai Mooncake, published on 2 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated attackers to crash the service by sending a zero-length handshake frame. Attackers can connect to the handshake port listening on all interfaces and send an eight-byte frame to terminate the hosting process, such as an SGLang inference server.
Weakness: CWE-125
Which versions are affected by CVE-2026-104433?
How do I fix CVE-2026-104433?
No fix has been published for CVE-2026-104433 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-104433 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-104433 exists.
Sources
Also known as GHSA-ccgr-wx5m-4h7g.