CVE-2026-103761: Mooncake transfer engine through 0.3.13.post1 Memory Exhaustion via Unbounded Notify Queue
Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePeerNotify that allows unauthenticated attackers to grow process memory without limit. Attackers can repeatedly send notify frames up to 1 MB to the handshake RPC port, filling the uncapped notifys vector until the out-of-memory killer terminates the engine.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Mooncake Transfer Engine deployments through 0.3.13.post1 are exposed if an attacker can reach the handshake RPC port over the network. The issue does not require authentication or user interaction.
What does an attacker need to do to trigger the memory exhaustion?
An attacker can repeatedly send notify frames, each up to 1 MB, to the handshake RPC port. The engine stores these frames in an uncapped notifys vector, allowing memory use to grow until the out-of-memory killer terminates the process.
How can I tell whether an instance may be under attack or affected?
Look for repeated notify traffic to the handshake RPC port together with continuously increasing Transfer Engine process memory usage. Affected processes may eventually be terminated by the operating system's out-of-memory killer.