https://vulnerability.circl.lu/sightings/feed 2026-09-26T20:20:30.735545+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/0b4a21e7-b014-4186-a7ec-2a9ec245f69a/export 2026-09-26T20:20:30.749353+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "0b4a21e7-b014-4186-a7ec-2a9ec245f69a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-QPXH-FF8M-C62V", "type": "seen", "source": "https://gist.github.com/alon710/9d482eefcb1d44ed932ab0b5e9532492", "content": "# GHSA-QPXH-FF8M-C62V: GHSA-QPXH-FF8M-C62V: Gas Draining and Resource Exhaustion in ZenHive mpp Library\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-25\n> **Full Report:** https://cvereports.com/reports/GHSA-QPXH-FF8M-C62V\n\n## Summary\nA critical gas draining vulnerability exists in the ZenHive mpp (Multi-Payment Protocol) library prior to version v0.6.0. By omitting validation of EIP-2930 access lists in custom 0x76 transaction envelopes, the library allows malicious clients to pad transaction payloads with dummy addresses, draining the gas sponsor's hot wallet.\n\n## TL;DR\nUnvalidated access list padding allows attackers to drain native tokens from sponsored gas wallets on EVM-compatible networks.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400, CWE-20\n- **Attack Vector**: Network / Remote\n- **CVSS Score**: 7.5 (High)\n- **Impact**: Wallet Fund Depletion / Denial of Service\n- **Exploit Status**: Proof of Concept available\n\n## Affected Systems\n\n- ZenHive mpp (Multi-Payment Protocol) Elixir library\n- **mpp**: < 0.6.0 (Fixed in: `0.6.0`)\n\n## Mitigation\n\n- Upgrade ZenHive mpp library to v0.6.0 or higher\n- Temporarily disable transaction fee sponsorship in application configuration\n\n**Remediation Steps:**\n1. Update mix.exs with {:mpp, \"~> 0.6.0\"}\n2. Run mix deps.get and mix compile to pull the patched version\n3. Verify the fee payer policy config is enabled and active\n\n## References\n\n- [GHSA-QPXH-FF8M-C62V Advisory Hub](https://github.com/advisories/GHSA-QPXH-FF8M-C62V)\n- [Patch Commit](https://github.com/ZenHive/mpp/commit/5d6338e2334084c5f2a78cfcca474830733ed7e8)\n- [Mpp Library Release v0.6.0](https://github.com/ZenHive/mpp/releases/tag/v0.6.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-QPXH-FF8M-C62V) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-26T01:30:32.000000Z"} 2026-09-26T01:30:32+00:00