{"id":"CVE-2026-73541","aliases":["GHSA-j4j7-7xpr-c7cr"],"url":"https://o3.security/vulnerability/CVE-2026-73541","summary":"Tempo fee sponsorship in mpp bounds each transaction but not aggregate exposure, allowing concurrent sponsor-wallet drain","details":"## Summary\n\nAllocation of Resources Without Limits or Throttling in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet through concurrent sponsored payments, denying service to legitimate payers once it is empty.\n\nMPP.Methods.Tempo.FeePayerPolicy enforces its ceilings (max\\_gas, max\\_fee\\_per\\_gas, max\\_priority\\_fee\\_per\\_gas, the worst-case gas\\_limit \\* max\\_fee\\_per\\_gas <= max\\_total\\_fee budget cap, and a validity window) against one transaction at a time, and nothing accounts for exposure across concurrent requests. reserve\\_hash\\_atomic/2 is keyed on the transaction hash, so it prevents duplicate broadcast of the same signed transaction but not N distinct sponsored transactions carrying distinct expiring nonces. Committed sponsor exposure is therefore N times max\\_total\\_fee, bounded by nothing in the library, and the default 900 second validity window lets co-signed transactions stay broadcastable and uncounted for that entire period.\n\nThis issue affects mpp: from 0.2.0 before 0.12.0.\n\n## Workaround\n\nDisable Tempo fee sponsorship by setting \"fee\\_payer\" => false (the default), so the client pays its own gas and the sponsor wallet is never committed. Where sponsorship must stay enabled, lowering max\\_total\\_fee and max\\_validity\\_window\\_seconds reduces the exposure each concurrent request can commit and how long it stays outstanding, without bounding the aggregate.\n\n## Configuration\n\nOnly deployments that enable Tempo server-side fee sponsorship are affected, through \"fee\\_payer\" => true in method\\_config with either local co-signing (fee\\_payer\\_private\\_key) or hosted sponsorship (fee\\_payer\\_url). Sponsorship is disabled by default.","published":"2026-08-19T17:20:00.286Z","modified":"2026-08-19T17:42:02.920680124Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Hex","name":"mpp","fixedVersion":"0.12.0"}],"fix":{"url":"https://github.com/ZenHive/mpp/commit/ddc46868fba57ccebb567c04709812b466123076","label":"ZenHive/mpp@ddc4686"},"references":[{"type":"ADVISORY","url":"https://github.com/ZenHive/mpp/security/advisories/GHSA-j4j7-7xpr-c7cr"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-73541.html"},{"type":"FIX","url":"https://github.com/ZenHive/mpp/commit/ddc46868fba57ccebb567c04709812b466123076"},{"type":"PACKAGE","url":"https://hex.pm/packages/mpp"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-19T17:42:02.920680124Z"}}