CyberRota Analysis
AI-GeneratedThe Mooncake transfer engine prior to version 0.3.12 is vulnerable to an out-of-bounds read in the readString function, which can be exploited by unauthenticated attackers to crash the service through a zero-length handshake frame. This vulnerability allows attackers to terminate processes like the SGLang inference server by sending a specific eight-byte frame to the handshake port. Organizations using affected versions should prioritize patching to mitigate the risk of service disruption.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated attackers to crash the service by sending a zero-length handshake frame. Attackers can connect to the handshake port listening on all interfaces and send an eight-byte frame to terminate the hosting process, such as an SGLang inference server.