CVE-2026-103760 — Mooncake transfer engine through 0.3.13.post1 Denial of Service via P2P Handshake Daemon Response Write
Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated remote attackers to block the handshake daemon by never read…
Published: 2026-10-01 · CVSS: 8.2 · CVSS 4.0
Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated remote attackers to block the handshake daemon by never reading replies. Attackers can send a Metadata request to the handshake RPC port and stall SocketHandShakePlugin's single listener thread in writeFully(), breaking all subsequent handshakes, metadata fetches, notify and probe requests.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7