CVE-2026-73541
Received Received - Intake

Allocation of Resources Without Limits in ZenHive mpp

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: EEF

Description
Allocation of Resources Without Limits or Throttling in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet through concurrent sponsored payments, denying service to legitimate payers once it is empty. MPP.Methods.Tempo.FeePayerPolicy enforces its ceilings (max_gas, max_fee_per_gas, max_priority_fee_per_gas, the worst-case gas_limit * max_fee_per_gas <= max_total_fee budget cap, and a validity window) against one transaction at a time, and nothing accounts for exposure across concurrent requests. reserve_hash_atomic/2 is keyed on the transaction hash, so it prevents duplicate broadcast of the same signed transaction but not N distinct sponsored transactions carrying distinct expiring nonces. Committed sponsor exposure is therefore N times max_total_fee, bounded by nothing in the library, and the default 900 second validity window lets co-signed transactions stay broadcastable and uncounted for that entire period. This issue affects mpp: from 0.2.0 before 0.12.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-73541
EUVD
EUVD-2026-62593

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
mpp mpp From 0.2.0 (inc) to 0.12.0 (exc)
zenhive mpp From 0.2.0 (inc) to 0.12.0 (exc)
zenhive mpp to 0.11.0 (inc)
zenhive mpp 0.12.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an allocation of resources without limits in the ZenHive mpp library's Tempo fee-payer sponsorship feature. It allows an unauthenticated remote attacker to drain the sponsor's wallet by submitting multiple concurrent sponsored payments. Each transaction passes individual limits, but the system does not track aggregate spending across concurrent requests, leading to unbounded fee exposure. The default 900-second validity window keeps transactions broadcastable and uncounted during that period.

Detection Guidance

Monitor for unusual spikes in transaction volume or fee payments from the sponsor wallet. Check for multiple concurrent sponsored transactions with distinct nonces. Inspect logs for HTTP 402 responses indicating sponsor capacity exhaustion.

Impact Analysis

An attacker could drain the fee-payer wallet, causing denial of service for legitimate payers once funds are depleted. The sponsor bears the gas costs while the attacker pays minimal per-request fees. Systems enabling Tempo fee sponsorship are vulnerable, especially those with hosted or local co-signing setups.

Compliance Impact

This vulnerability could lead to unauthorized financial transactions and service disruptions, potentially violating data integrity and availability requirements in GDPR and HIPAA. Uncontrolled wallet draining may result in unauthorized access to sensitive payment data or denial of critical services, which are key compliance concerns under these regulations.

Mitigation Strategies

Upgrade to mpp version 0.12.0 or later. Disable Tempo fee sponsorship if not required. Reduce max_total_fee and max_validity_window_seconds as temporary measures. Implement rate limiting on sponsored transactions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73541. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart