Tools AI Risk Radar ai-incident-0130
Incident record
Mooncake fixes a handshake that crashes AI workers
- Severity
- High
- Status
- Patched
- Type
- Infra Vuln
- Target
- Mooncake before 0.3.12
- Actor
- researcher
- CVE
- CVE-2026-104433
What happened
An unauthenticated client able to reach Mooncake’s handshake port can crash its host process by sending a zero-length handshake. Researchers demonstrated a SGLang worker crash. The CVE was published late on 2 October and rates the flaw 7.5 High under CVSS 3.1.
Mooncake 0.3.12 contains the fix. This has a separate version boundary from the memory-access and metadata-server vulnerabilities elsewhere in the tracker.
Sources
- CVE recordcveawg.mitre.org/api/cve/CVE-2026-104433
- Researcher reportgithub.com/kvcache-ai/Mooncake/issues/4452
- Fix commitgithub.com/kvcache-ai/Mooncake/commit/c142b40590259360196d8e…
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026