PT-2026-104455

Name of the Vulnerable Software and Affected Versions Mooncake transfer engine versions prior to 0.3.12 Description An out-of-bounds read occurs in the readString function within include/common.h. This allows unauthenticated attackers to crash the service, such as an SGLang inference server, by...

PT-2026-105469

Impact Wasmtime's implementation of bulk-data-transfer WebAssembly instructions, such as memory.copy, contains a vulnerability when a preemption via epochs or fuel is combined with altering the store's state or cancelling a computation. To prevent these operations from taking too long Wasmtime...

CVE-2026-103764: Untrusted Pointer Dereference

Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. Attackers can send a crafted SessionHeader with arbitrary addr and size...

CVE-2026-103764

The Mooncake transfer engine (versions prior to 0.3.13 ) is vulnerable to an untrusted pointer dereference within the ServerSession::readHeader function. This flaw allows unauthenticated attackers to perform arbitrary memory read and write operations via the TCP transport data port . By sending a...

CVE-2026-103764 Mooncake transfer engine before 0.3.13 Unauthenticated Arbitrary Memory Read/Write via TCP Transport

Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. Attackers can send a crafted SessionHeader with arbitrary addr and size...

CVE-2026-103764 Mooncake transfer engine before 0.3.13 Unauthenticated Arbitrary Memory Read/Write via TCP Transport

Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. Attackers can send a crafted SessionHeader with arbitrary addr and size...

CVE-2026-103764 Mooncake transfer engine before 0.3.13 Unauthenticated Arbitrary Memory Read/Write via TCP Transport

Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. Attackers can send a crafted SessionHeader with arbitrary addr and size...

CVE-2026-103760

Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated remote attackers to block the handshake daemon by never reading replies. Attackers can send a Metadata request to the handshake RPC port and stall SocketHandShakePlugin's single...

CVE-2026-103761

The Mooncake transfer engine (versions prior to 0.3.14 ) contains a memory exhaustion vulnerability located in the TransferMetadata::receivePeerNotify function. An unauthenticated attacker can cause the process memory to grow without limit by repeatedly sending notify frames (up to 1 MB) to the h...

CVE-2026-103761 Mooncake transfer engine through 0.3.13.post1 Memory Exhaustion via Unbounded Notify Queue

Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePeerNotify that allows unauthenticated attackers to grow process memory without limit. Attackers can repeatedly send notify frames up to 1 MB to the handshake RPC port, filling the...

CVE-2026-103761 Mooncake transfer engine through 0.3.13.post1 Memory Exhaustion via Unbounded Notify Queue

Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePeerNotify that allows unauthenticated attackers to grow process memory without limit. Attackers can repeatedly send notify frames up to 1 MB to the handshake RPC port, filling the...

CVE-2026-103761 Mooncake transfer engine through 0.3.13.post1 Memory Exhaustion via Unbounded Notify Queue

Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePeerNotify that allows unauthenticated attackers to grow process memory without limit. Attackers can repeatedly send notify frames up to 1 MB to the handshake RPC port, filling the...

CVE-2026-103760 Mooncake transfer engine through 0.3.13.post1 Denial of Service via P2P Handshake Daemon Response Write

Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated remote attackers to block the handshake daemon by never reading replies. Attackers can send a Metadata request to the handshake RPC port and stall SocketHandShakePlugin's single...

CVE-2026-103760

The Mooncake transfer engine (versions prior to 0.3.14 ) is susceptible to a denial of service (DoS) vulnerability. An unauthenticated remote attacker can block the handshake daemon by sending a Metadata request to the handshake RPC port and failing to read the replies. This action stalls the sin...

CVE-2026-103760 Mooncake transfer engine through 0.3.13.post1 Denial of Service via P2P Handshake Daemon Response Write

Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated remote attackers to block the handshake daemon by never reading replies. Attackers can send a Metadata request to the handshake RPC port and stall SocketHandShakePlugin's single...

CVE-2026-103760 Mooncake transfer engine through 0.3.13.post1 Denial of Service via P2P Handshake Daemon Response Write

Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated remote attackers to block the handshake daemon by never reading replies. Attackers can send a Metadata request to the handshake RPC port and stall SocketHandShakePlugin's single...

DEBIAN-CVE-2026-63718

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' response smuggling vulnerability in Apache HTTP Server via modproxyuwsgi and a crafted uwsgi response with Transfer-Encoding. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.68...

UBUNTU-CVE-2026-63718

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' response smuggling vulnerability in Apache HTTP Server via modproxyuwsgi and a crafted uwsgi response with Transfer-Encoding. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.68...

CVE-2026-63718

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' response smuggling vulnerability in Apache HTTP Server via modproxyuwsgi and a crafted uwsgi response with Transfer-Encoding. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.68...

urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory

Impacturllib3's streaming API is designed for efficiently handling large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When decoding a chunked-transfer-encoded response, this API reads each chunk's size field by buffering until ...