CVE-2026-96764: kvcache-ai mooncake Regular Expression GetReplicaListByRegex allocation of resources
A weakness has been identified in kvcache-ai mooncake up to 0.3.12/0.3.14-rc1. Impacted is the function MasterService::GetReplicaListByRegex of the component Regular Expression Handler. Executing a manipulation can lead to allocation of resources. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker with low privileges can exploit it. No user interaction is required.
What is the expected impact of exploitation?
Successful exploitation can cause resource allocation through the Regular Expression Handler, resulting in a low availability impact. No confidentiality or integrity impact is identified in the provided severity vector.
Is exploit code available?
Yes. The exploit has been made public and could be used in attacks.
Which releases are identified as affected?
The issue is reported in kvcache-ai mooncake up to 0.3.12 and 0.3.14-rc1. The provided information does not identify a fixed release or mitigation.