CVE-2026-59252

Full vulnerability record from the local CVENow database.

Description

Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet, resulting in denial of service for legitimate clients. When the mpp Elixir library is configured as fee payer (fee_payer: true), the MPP.Methods.Tempo payment method co-signs and broadcasts a client-supplied EVM transaction without first validating that the client-supplied gas_limit is sufficient to complete the intended call. A malicious client can submit a signed transferWithMemo transaction with gas_limit deliberately set just below the amount required for successful execution. The server co-signs the transaction and broadcasts it via rpc_broadcast_sync. The transaction runs out of gas during EVM execution and reverts, but the fee-payer wallet is still charged for the burned gas while the client pays nothing and receives no resource. Repeated requests from one or more malicious clients drain the fee-payer wallet at near-zero cost to the attacker, ultimately preventing the server from sponsoring gas for legitimate payment requests. The wait_for_confirmation = false (optimistic) path is also affected: it invokes simulate_payment_call via eth_call, but that simulation omits the gas parameter and therefore does not catch out-of-gas conditions. This issue affects mpp: from 0.2.0 before 0.6.0.

Severity

HIGH

CVSS score

8.2 (v4.0)

Vulnerability status

Deferred

Source identifier

6b3ad84c-e1a6-4bf7-a703-f496b71e49db

Published

2026-07-17 11:17:13.803000

Last modified

2026-10-24 20:10:00.137000

View original CVE JSON

{
  "id": "CVE-2026-59252",
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "published": "2026-07-17T11:17:13.803",
  "lastModified": "2026-10-24T20:10:00.137",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet, resulting in denial of service for legitimate clients.\n\nWhen the mpp Elixir library is configured as fee payer (fee_payer: true), the MPP.Methods.Tempo payment method co-signs and broadcasts a client-supplied EVM transaction without first validating that the client-supplied gas_limit is sufficient to complete the intended call. A malicious client can submit a signed transferWithMemo transaction with gas_limit deliberately set just below the amount required for successful execution. The server co-signs the transaction and broadcasts it via rpc_broadcast_sync. The transaction runs out of gas during EVM execution and reverts, but the fee-payer wallet is still charged for the burned gas while the client pays nothing and receives no resource. Repeated requests from one or more malicious clients drain the fee-payer wallet at near-zero cost to the attacker, ultimately preventing the server from sponsoring gas for legitimate payment requests.\n\nThe wait_for_confirmation = false (optimistic) path is also affected: it invokes simulate_payment_call via eth_call, but that simulation omits the gas parameter and therefore does not catch out-of-gas conditions.\n\nThis issue affects mpp: from 0.2.0 before 0.6.0."
    },
    {
      "lang": "es",
      "value": "Validación Incorrecta de Cantidad Especificada en la Entrada en ZenHive mpp permite a un cliente remoto no autenticado vaciar la billetera del pagador de tarifas, lo que resulta en denegación de servicio para clientes legítimos.\n\nCuando la biblioteca mpp Elixir está configurada como pagador de tarifas (fee_payer: true), el método de pago MPP.Methods.Tempo co-firma y transmite una transacción EVM suministrada por el cliente sin validar primero que el gas_limit suministrado por el cliente sea suficiente para completar la llamada prevista. Un cliente malicioso puede enviar una transacción transferWithMemo firmada con el gas_limit deliberadamente establecido justo por debajo de la cantidad requerida para una ejecución exitosa. El servidor co-firma la transacción y la transmite a través de rpc_broadcast_sync. La transacción se queda sin gas durante la ejecución de EVM y se revierte, pero a la billetera del pagador de tarifas aún se le cobra por el gas quemado mientras que el cliente no paga nada y no recibe ningún recurso. Solicitudes repetidas de uno o más clientes maliciosos vacían la billetera del pagador de tarifas a un costo casi nulo para el atacante, lo que en última instancia impide que el servidor patrocine gas para solicitudes de pago legítimas.\n\nLa ruta wait_for_confirmation = false (optimista) también se ve afectada: invoca simulate_payment_call a través de eth_call, pero esa simulación omite el parámetro gas y por lo tanto no detecta las condiciones de falta de gas.\n\nEste problema afecta a mpp: desde 0.2.0 antes de 0.6.0."
    }
  ],
  "affected": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "affectedData": [
        {
          "vendor": "ZenHive",
          "product": "mpp",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.hex.pm",
          "packageName": "mpp",
          "cpes": [
            "cpe:2.3:a:ZenHive:mpp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "'Elixir.MPP.Methods.Tempo'"
          ],
          "programFiles": [
            "lib/mpp/methods/tempo.ex"
          ],
          "programRoutines": [
            {
              "name": "'Elixir.MPP.Methods.Tempo':broadcast_and_verify/7"
            }
          ],
          "repo": "https://github.com/ZenHive/mpp",
          "packageURL": "pkg:hex/mpp",
          "versions": [
            {
              "version": "0.2.0",
              "lessThan": "0.6.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "ZenHive",
          "product": "mpp",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com",
          "packageName": "ZenHive/mpp",
          "cpes": [
            "cpe:2.3:a:ZenHive:mpp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "'Elixir.MPP.Methods.Tempo'"
          ],
          "programFiles": [
            "lib/mpp/methods/tempo.ex"
          ],
          "programRoutines": [
            {
              "name": "'Elixir.MPP.Methods.Tempo':broadcast_and_verify/7"
            }
          ],
          "repo": "https://github.com/ZenHive/mpp",
          "packageURL": "pkg:github/ZenHive/mpp",
          "versions": [
            {
              "version": "d29d54e507918db00a5b65d90136b73166c017d7",
              "lessThan": "d84e3e528db39654540c2035ea0fbdf7b950d3d1",
              "versionType": "git",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-17T12:21:12.801804Z",
          "id": "CVE-2026-59252",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1284"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://cna.erlef.org/cves/CVE-2026-59252.html",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/ZenHive/mpp/commit/d84e3e528db39654540c2035ea0fbdf7b950d3d1",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/ZenHive/mpp/security/advisories/GHSA-vj8p-hp9x-gh47",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-59252",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/ZenHive/mpp/security/advisories/GHSA-vj8p-hp9x-gh47",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}