{"id":"CVE-2026-104433","summary":"Mooncake before 0.3.12 Out-of-Bounds Read via P2P Handshake readString","details":"Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated attackers to crash the service by sending a zero-length handshake frame. Attackers can connect to the handshake port listening on all interfaces and send an eight-byte frame to terminate the hosting process, such as an SGLang inference server.","modified":"2026-10-04T07:03:19.285279Z","published":"2026-10-02T23:28:44.691Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104433.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104433.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104433"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/mooncake-before-0.3.12-out-of-bounds-read-via-p2p-handshake-readstring"},{"type":"REPORT","url":"https://github.com/kvcache-ai/Mooncake/issues/4452"},{"type":"FIX","url":"https://github.com/kvcache-ai/Mooncake/commit/c142b40590259360196d8e504b2193382529e7b4"},{"type":"PACKAGE","url":"https://github.com/kvcache-ai/Mooncake"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/kvcache-ai/mooncake","events":[{"introduced":"0"},{"fixed":"c7ae97fd24251ed0aaaa613e8251859f170f1ae7"},{"fixed":"c142b40590259360196d8e504b2193382529e7b4"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"0.3.12"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["v0.3.11-rc1","v0.3.11.post1","v0.3.11","v0.3.10.post2","v0.3.10.post1","v0.3.10","v0.3.9","v0.3.8.post1","v0.3.8","v0.3.7.post2","v0.3.7.post1","v0.3.7","v0.3.6.post1","v0.3.6","v0.3.5","v0.3.4.post2","v0.3.4.post1","v0.3.4","v0.3.3.post2","v0.3.3.post1","v0.3.3","v0.3.2.post1","v0.3.2","v0.3.1","v0.3.0","v0.3.0-beta","v0.3.0-alpha","v0.2.0"],"database_specific":{"vanir_signatures_modified":"2026-10-04T07:03:19Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["205696808118481514438618394071282174364","252703981900679507375191080287019195791","123290894177174466210025112847491926467"],"threshold":0.9},"id":"CVE-2026-104433-1074f921","signature_type":"Line","signature_version":"v1","source":"https://github.com/kvcache-ai/mooncake/commit/c142b40590259360196d8e504b2193382529e7b4","target":{"file":"mooncake-transfer-engine/include/common.h"}},{"id":"CVE-2026-104433-34e36257","signature_type":"Line","signature_version":"v1","source":"https://github.com/kvcache-ai/mooncake/commit/c142b40590259360196d8e504b2193382529e7b4","target":{"file":"mooncake-transfer-engine/src/transfer_engine_impl.cpp"},"deprecated":false,"digest":{"line_hashes":["208626284151766976122132100156730131416","53443675378967298753025647378223473023","220466968840857572433313147237698444549","153616159007328621715590750309945105847"],"threshold":0.9}},{"source":"https://github.com/kvcache-ai/mooncake/commit/c142b40590259360196d8e504b2193382529e7b4","target":{"file":"mooncake-transfer-engine/include/common.h","function":"readString"},"deprecated":false,"digest":{"function_hash":"41662267458183126134998144721204259552","length":946},"id":"CVE-2026-104433-52bff35e","signature_type":"Function","signature_version":"v1"},{"target":{"file":"mooncake-transfer-engine/src/transfer_metadata_plugin.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["289821992277650586352305565484500038508","208236549094587803094933737729992914072","185180219706740571168939907307478940434","148268215849480185960938913399340285723","289821992277650586352305565484500038508","208236549094587803094933737729992914072","185180219706740571168939907307478940434","148268215849480185960938913399340285723","289821992277650586352305565484500038508","208236549094587803094933737729992914072","185180219706740571168939907307478940434","148268215849480185960938913399340285723","289821992277650586352305565484500038508","208236549094587803094933737729992914072","185180219706740571168939907307478940434","148268215849480185960938913399340285723"]},"id":"CVE-2026-104433-58a86c30","signature_type":"Line","signature_version":"v1","source":"https://github.com/kvcache-ai/mooncake/commit/c142b40590259360196d8e504b2193382529e7b4"},{"id":"CVE-2026-104433-7344edfa","signature_type":"Function","signature_version":"v1","source":"https://github.com/kvcache-ai/mooncake/commit/c142b40590259360196d8e504b2193382529e7b4","target":{"file":"mooncake-transfer-engine/src/transfer_engine_impl.cpp","function":"TransferEngineImpl::sendNotifyByID"},"deprecated":false,"digest":{"length":225,"function_hash":"92408173803971510115170564095493341524"}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104433.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}