PT-2026-104455

Name of the Vulnerable Software and Affected Versions Mooncake transfer engine versions prior to 0.3.12 Description An out-of-bounds read occurs in the readString function within include/common.h. This allows unauthenticated attackers to crash the service, such as an SGLang inference server, by...

CentOS Linux 8.4 [TuxCare] Security Update: openssl / openssl-devel / openssl-libs / openssl-perl / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1790933443)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1790933443 advisory. - Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when...

CentOS Linux 8 [TuxCare] Security Update: openssl / openssl-devel / openssl-libs / openssl-perl / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1790933563)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1790933563 advisory. - Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when...

CVE-2026-103761

Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePeerNotify that allows unauthenticated attackers to grow process memory without limit. Attackers can repeatedly send notify frames up to 1 MB to the handshake RPC port, filling the...

CVE-2026-103760

Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated remote attackers to block the handshake daemon by never reading replies. Attackers can send a Metadata request to the handshake RPC port and stall SocketHandShakePlugin's single...

CVE-2026-103761 Mooncake transfer engine through 0.3.13.post1 Memory Exhaustion via Unbounded Notify Queue

Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePeerNotify that allows unauthenticated attackers to grow process memory without limit. Attackers can repeatedly send notify frames up to 1 MB to the handshake RPC port, filling the...

CVE-2026-103761

The Mooncake transfer engine (versions prior to 0.3.14 ) contains a memory exhaustion vulnerability located in the TransferMetadata::receivePeerNotify function. An unauthenticated attacker can cause the process memory to grow without limit by repeatedly sending notify frames (up to 1 MB) to the h...

CVE-2026-103761 Mooncake transfer engine through 0.3.13.post1 Memory Exhaustion via Unbounded Notify Queue

Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePeerNotify that allows unauthenticated attackers to grow process memory without limit. Attackers can repeatedly send notify frames up to 1 MB to the handshake RPC port, filling the...

CVE-2026-103761 Mooncake transfer engine through 0.3.13.post1 Memory Exhaustion via Unbounded Notify Queue

Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePeerNotify that allows unauthenticated attackers to grow process memory without limit. Attackers can repeatedly send notify frames up to 1 MB to the handshake RPC port, filling the...

CVE-2026-103760 Mooncake transfer engine through 0.3.13.post1 Denial of Service via P2P Handshake Daemon Response Write

Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated remote attackers to block the handshake daemon by never reading replies. Attackers can send a Metadata request to the handshake RPC port and stall SocketHandShakePlugin's single...

CVE-2026-103760

The Mooncake transfer engine (versions prior to 0.3.14 ) is susceptible to a denial of service (DoS) vulnerability. An unauthenticated remote attacker can block the handshake daemon by sending a Metadata request to the handshake RPC port and failing to read the replies. This action stalls the sin...

CVE-2026-103760 Mooncake transfer engine through 0.3.13.post1 Denial of Service via P2P Handshake Daemon Response Write

Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated remote attackers to block the handshake daemon by never reading replies. Attackers can send a Metadata request to the handshake RPC port and stall SocketHandShakePlugin's single...

CVE-2026-103760 Mooncake transfer engine through 0.3.13.post1 Denial of Service via P2P Handshake Daemon Response Write

Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated remote attackers to block the handshake daemon by never reading replies. Attackers can send a Metadata request to the handshake RPC port and stall SocketHandShakePlugin's single...

AlmaLinux 9.2 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ALMALINUX9.2:CLSA-2025:1737654382)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1737654382 advisory. - Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 throu...

AlmaLinux 9.2 [TuxCare] Security Update: squid (ALMALINUX9.2:CLSA-2024:1735126310)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1735126310 advisory. - Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prio...

Rocky Linux 9 [CIQ] Security Update: java-17-openjdk / java-17-openjdk-debuginfo / etc Multiple Vulnerabilities (crlsa-2023_1879)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20231879 advisory. OpenJDK: improper connection handling during TLS handshake 8294474 CVE-2023-21930 OpenJDK: Swing HTML parsing issue 8296832 CVE-2023-21939 OpenJDK: incorre...

AlmaLinux 9.2 [TuxCare] Security Update: gnutls / gnutls-c++ / gnutls-dane / gnutls-devel / gnutls-utils (ALMALINUX9.2:CLSA-2026:1778762233)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778762233 advisory. - A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow...

PT-2026-105173

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the stream protocol stored the FrameMax value negotiated during the Tune handshake but did not compare it with an inbound frame's declared length before buffering the frame. With the stream plugin...

Rocky Linux 8 [CIQ] Security Update: java-17-openjdk / java-17-openjdk-debuginfo / etc Multiple Vulnerabilities (crlsa-2021_4135)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20214135 advisory. OpenJDK: Incorrect principal selection when using Kerberos Constrained Delegation Libraries, 8266689 CVE-2021-35567 OpenJDK: Excessive memory allocation in...

Rocky Linux 8 [CIQ] Security Update: hivex / hivex-debuginfo / hivex-debugsource / hivex-devel / etc (crlsa-2026_5578)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20265578 advisory. qemu-kvm: VNC WebSocket handshake use-after-free CVE-2025-11234 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note...