{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/mooncake-transfer-engine--0.3.13.post1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mooncake:transfer_engine:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-103761"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Mooncake transfer engine (\u003c= 0.3.13.post1)"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","vulnerability","network"],"_cs_type":"advisory","_cs_vendors":["Mooncake"],"content_html":"\u003cp\u003eThe Mooncake transfer engine, in versions up to and including 0.3.13.post1, is susceptible to a memory exhaustion vulnerability located within the TransferMetadata::receivePeerNotify function. This vulnerability stems from a lack of bounds checking on the notifys vector, which handles incoming peer notification frames. An unauthenticated attacker can exploit this by repeatedly transmitting 1 MB notify frames to the handshake RPC port. Because the system does not cap the size or count of these frames, the process memory usage grows monotonically until the operating system's out-of-memory (OOM) killer is invoked to terminate the engine. This results in a persistent denial-of-service condition, impacting the availability of the transfer service. Defenders should prioritize updating to the next patched release once available and implement rate limiting on the RPC handshake port to mitigate exploitation attempts.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the immediate termination of the Mooncake transfer engine process via the system OOM killer, causing a denial-of-service. This impacts any infrastructure relying on Mooncake for data transfer operations. No data modification or execution is currently associated with this memory exhaustion vulnerability, but the interruption of service could disrupt critical business processes.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor RPC traffic to the handshake port for high volumes of large frames (1 MB) originating from unauthorized sources.\u003c/li\u003e\n\u003cli\u003eApply network-level rate limiting or connection throttling on the handshake RPC port as an immediate defensive measure.\u003c/li\u003e\n\u003cli\u003eMonitor system logs for OOM killer events or unexpected crashes of the Mooncake process.\u003c/li\u003e\n\u003cli\u003eUpgrade the Mooncake transfer engine to a version beyond 0.3.13.post1 immediately upon vendor release.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-02T00:19:56Z","date_published":"2026-10-02T00:19:56Z","id":"https://feed.craftedsignal.io/briefs/2026-10-mooncake-dos/","summary":"An unauthenticated memory exhaustion vulnerability in the Mooncake transfer engine (CVE-2026-103761) allows remote attackers to trigger a denial-of-service condition by repeatedly sending large notify frames to the handshake RPC port.","title":"Memory Exhaustion Vulnerability in Mooncake Transfer Engine","url":"https://feed.craftedsignal.io/briefs/2026-10-mooncake-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Mooncake Transfer Engine (\u003c= 0.3.13.post1)","version":"https://jsonfeed.org/version/1.1"}