This vulnerability in kvcache-ai mooncake up to versions 0.3.12 and 0.3.14-rc1 involves improper handling in the MasterService::GetReplicaListByRegex function within the Regular Expression Handler component. Remote attackers can exploit this weakness by manipulating input to trigger resource allocation, which may lead to resource exhaustion or denial of service conditions. The vulnerability has been assigned CVE-2026-96764 and has a medium severity rating with a CVSS 4.0 score of 5.3. Public exploit code is available, but no vendor fix or advisory has been issued as the vendor did not respond to disclosure attempts.

Successful exploitation allows remote attackers to cause allocation of resources in the affected function, which could degrade system performance or availability. There is no indication of privilege escalation, data disclosure, or integrity impact. The medium CVSS score reflects the moderate impact of resource consumption without direct compromise of confidentiality or integrity.

No official fix or patch is currently available as the vendor has not responded to disclosure. Users should monitor for vendor advisories for any future updates. Until a patch is released, consider limiting access to the affected service or applying network-level controls to restrict untrusted remote access to the vulnerable function. Given the public availability of exploit code, heightened vigilance is advised.