ZenHive mpp up to 0.5.9 Tempo rpc_broadcast_sync gas_limit denial of service

Summaryinfo

A vulnerability, which was classified as problematic, has been found in ZenHive mpp up to 0.5.9. This issue affects the function rpc_broadcast_sync of the component Tempo. Performing a manipulation of the argument gas_limit results in denial of service. This vulnerability is cataloged as CVE-2026-59252. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in ZenHive mpp up to 0.5.9. It has been classified as problematic. This affects the function rpc_broadcast_sync of the component Tempo. The manipulation of the argument gas_limit with an unknown input leads to a denial of service vulnerability. CWE is classifying the issue as CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. This is going to have an impact on availability. The summary by CVE is:

Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet, resulting in denial of service for legitimate clients. When the mpp Elixir library is configured as fee payer (fee_payer: true), the MPP.Methods.Tempo payment method co-signs and broadcasts a client-supplied EVM transaction without first validating that the client-supplied gas_limit is sufficient to complete the intended call. A malicious client can submit a signed transferWithMemo transaction with gas_limit deliberately set just below the amount required for successful execution. The server co-signs the transaction and broadcasts it via rpc_broadcast_sync. The transaction runs out of gas during EVM execution and reverts, but the fee-payer wallet is still charged for the burned gas while the client pays nothing and receives no resource. Repeated requests from one or more malicious clients drain the fee-payer wallet at near-zero cost to the attacker, ultimately preventing the server from sponsoring gas for legitimate payment requests. The wait_for_confirmation = false (optimistic) path is also affected: it invokes simulate_payment_call via eth_call, but that simulation omits the gas parameter and therefore does not catch out-of-gas conditions. This issue affects mpp: from 0.2.0 before 0.6.0.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-59252 since 07/04/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

Upgrading to version 0.6.0 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• ZenHive

Name

• mpp

Version

• 0.5.0
• 0.5.1
• 0.5.2
• 0.5.3
• 0.5.4
• 0.5.5
• 0.5.6
• 0.5.7
• 0.5.8
• 0.5.9

Website

• Product: https://github.com/ZenHive/mpp/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion