CyberRota Analysis
AI-GeneratedThe Mooncake transfer engine is vulnerable to a memory exhaustion flaw that allows unauthenticated attackers to send excessive notify frames, leading to unbounded memory growth and potential service disruption. This can result in the engine being terminated by the out-of-memory killer, impacting availability. Organizations using this transfer engine should prioritize patching to mitigate the risk of denial-of-service attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePeerNotify that allows unauthenticated attackers to grow process memory without limit. Attackers can repeatedly send notify frames up to 1 MB to the handshake RPC port, filling the uncapped notifys vector until the out-of-memory killer terminates the engine.