ZenHive mpp up to 0.5.9 Transaction cosign_fee_payer max_fee_per_gas/max_priority_fee_per_gas memory corruption

Summaryinfo

A vulnerability described as problematic has been identified in ZenHive mpp up to 0.5.9. Affected by this issue is the function cosign_fee_payer of the component Transaction. The manipulation of the argument max_fee_per_gas/max_priority_fee_per_gas results in memory corruption. This vulnerability is identified as CVE-2026-59695. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in ZenHive mpp up to 0.5.9. Affected is the function cosign_fee_payer of the component Transaction. The manipulation of the argument max_fee_per_gas/max_priority_fee_per_gas with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on availability. CVE summarizes:

Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet in a single request by naming an arbitrarily high gas price. When the mpp Elixir library is configured as fee payer (fee_payer: true), MPP.Tempo.Transaction.cosign_fee_payer/3 re-signs the client-supplied base fields of the 0x76 AASigned envelope verbatim, including max_fee_per_gas and max_priority_fee_per_gas, without validating that they are within reasonable bounds. A malicious client embeds arbitrarily large values for these fields in the signed envelope. The server co-signs and broadcasts the transaction. The effective_gas_price billed against the fee-payer wallet is derived from the attacker-supplied ceilings, so the server pays those inflated per-gas rates out of its own wallet. A single crafted request can drain the wallet entirely, after which the server can no longer sponsor gas for legitimate payment requests. This issue affects mpp: from 0.2.0 before 0.6.0.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-59695 since 07/06/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available.

Upgrading to version 0.6.0 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• ZenHive

Name

• mpp

Version

• 0.5.0
• 0.5.1
• 0.5.2
• 0.5.3
• 0.5.4
• 0.5.5
• 0.5.6
• 0.5.7
• 0.5.8
• 0.5.9

Website

• Product: https://github.com/ZenHive/mpp/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion