Is CVE-2026-96764 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-96764 being exploited in the wild.

How severe is CVE-2026-96764?

Medium severity, with a CVSS score of 4.3, published 24 September 2026.

Which products and versions are affected?

Kvcache-Ai Mooncake up to 0.3.12 and 0.3.14-rc1.

Is there a fix for CVE-2026-96764?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-96764 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-96764?

Check whether you run Kvcache-Ai Mooncake at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96764: kvcache-ai mooncake denial of service in regex metadata queries

CVE-2026-96764 · Severity: medium · CVSS 4.3 · Published 2026-09-24

Mooncake is a distributed key-value cache system. An attacker can perform low-rate remote queries using broad regular expressions to prevent legitimate users from storing data, reducing their ability to write to the cache from 93.5% success to 54.5% by blocking eviction of other users' objects in the same tenant. The vendor did not respond to early disclosure.

Technologies: Kvcache-Ai Mooncake. Vendors: Kvcache-Ai.

Quick answers

Is CVE-2026-96764 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-96764 being exploited in the wild.
How severe is CVE-2026-96764?: Medium severity, with a CVSS score of 4.3, published 24 September 2026.
Which products and versions are affected?: Kvcache-Ai Mooncake up to 0.3.12 and 0.3.14-rc1.
Is there a fix for CVE-2026-96764?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-96764 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-96764?: Check whether you run Kvcache-Ai Mooncake at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a resource exhaustion flaw in MasterService::GetReplicaListByRegex. The function grants or refreshes object leases for every match to a supplied regex pattern without bounding the number of objects affected. An attacker repeatedly queries a broad pattern like .* at intervals shorter than the lease TTL, causing nearly all tenant objects to remain ineligible for eviction. This is a same-tenant denial of service requiring network access to the Master RPC interface; no authentication bypass or cross-tenant impact is demonstrated.

Affected products

kvcache-ai mooncake up to 0.3.12 and 0.3.14-rc1

Timeline

2026-07-24: disclosed: PoC report published on GitHub
2026-09-24: advisory: CVE-2026-96764 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.