| Título | kvcache-ai mooncake >= 0.3.4, <= 0.3.12 Denial of Service |
|---|
| Descrição | Mooncake Store v0.3.12 grants or refreshes a lease for every object matched by QueryByRegex. A client can repeatedly query the broad regular expression .* before the lease TTL expires, keeping nearly all objects in the same tenant continuously protected from eviction without actually reading the underlying data.
When the Store is near capacity, other clients sharing the tenant and memory pool can no longer reclaim sufficient space through eviction. Their Put operations fail, while the Master repeatedly attempts eviction but finds few or no eligible objects.
In a controlled experiment using separate query and writer clients, five regex queries over approximately ten seconds—about 0.4 requests per second—reduced the victim's Put success rate from 93.5% to 54.5%. Removing only the regex-path lease grant restored the success rate to 93.5%, and stopping the query traffic allowed normal allocation to recover after the lease TTL expired.
This is a same-tenant availability and uncontrolled-resource-consumption issue. No confidentiality or integrity impact, and no cross-tenant impact, have been demonstrated.
Provisional severity: Moderate. Severity may be higher if the Master RPC interface is expected to be reachable by mutually untrusted or unauthenticated clients.
The confirmed PoC uses supported but non-default TTL and eviction settings, as documented below. Reproduction under the complete v0.3.12 default configuration is still in progress. |
|---|
| Fonte | ⚠️ https://gist.github.com/yyymk/4699cc95ab9a559ee15a0fb798bd6c5d |
|---|
| Utilizador | YYYMK (UID 100105) |
|---|
| Submissão | 24/07/2026 20h25 (há 2 meses) |
|---|
| Moderação | 23/09/2026 18h01 (2 months later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 409019 [kvcache-ai mooncake até 0.3.12/0.3.14-rc1 Regular Expression GetReplicaListByRegex Negação de Serviço] |
|---|
| Pontos | 20 |
|---|