# CVE-2026-96764: kvcache-ai mooncake denial of service in regex metadata queries

Source: https://junglewise.ai/threats/cve-2026-96764-a-weakness-has-been-identified-in-kvcache-ai-mooncake-up-to-0-3  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-96764 · Severity: medium · CVSS 4.3 · Published 2026-09-24

Mooncake is a distributed key-value cache system. An attacker can perform low-rate remote queries using broad regular expressions to prevent legitimate users from storing data, reducing their ability to write to the cache from 93.5% success to 54.5% by blocking eviction of other users' objects in the same tenant. The vendor did not respond to early disclosure.

Technologies: [Kvcache-Ai Mooncake](https://junglewise.ai/threats/technologies/mooncake). Vendors: [Kvcache-Ai](https://junglewise.ai/threats/vendors/kvcache-ai).

## Quick answers

**Is CVE-2026-96764 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-96764 being exploited in the wild.

**How severe is CVE-2026-96764?** Medium severity, with a CVSS score of 4.3, published 24 September 2026.

**Which products and versions are affected?** Kvcache-Ai Mooncake up to 0.3.12 and 0.3.14-rc1.

**Is there a fix for CVE-2026-96764?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-96764 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-96764?** Check whether you run Kvcache-Ai Mooncake at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a resource exhaustion flaw in MasterService::GetReplicaListByRegex. The function grants or refreshes object leases for every match to a supplied regex pattern without bounding the number of objects affected. An attacker repeatedly queries a broad pattern like .* at intervals shorter than the lease TTL, causing nearly all tenant objects to remain ineligible for eviction. This is a same-tenant denial of service requiring network access to the Master RPC interface; no authentication bypass or cross-tenant impact is demonstrated.

## Affected products

- kvcache-ai mooncake up to 0.3.12 and 0.3.14-rc1

## Timeline

- 2026-07-24: disclosed: PoC report published on GitHub
- 2026-09-24: advisory: CVE-2026-96764 published

## References

- [https://gist.github.com/yyymk/4699cc95ab9a559ee15a0fb798bd6c5d](https://gist.github.com/yyymk/4699cc95ab9a559ee15a0fb798bd6c5d)
- [https://vuldb.com/cve/CVE-2026-96764](https://vuldb.com/cve/CVE-2026-96764)

## Related threats

- [Mooncake missing authentication in HTTP metadata server](https://junglewise.ai/threats/cve-2026-103765-mooncake-through-0-3-13-post1-contains-a-missing-authentication)
- [kvcache-ai Mooncake access control bypass in MountSegment](https://junglewise.ai/threats/cve-2026-96763-a-security-flaw-has-been-discovered-in-kvcache-ai-mooncake-up-to)
- [Kvcache-ai Mooncake authorization bypass in RPC segment handler](https://junglewise.ai/threats/cve-2026-96762-a-vulnerability-was-determined-in-kvcache-ai-mooncake-up-to-0-3)