Improper input validation in the ZenHive mpp Elixir library (CVE-2026-59252)

CVE-2026-59252 is an improper input validation vulnerability in the ZenHive mpp Elixir library affecting deployments configured as a fee payer. When acting as fee payer, mpp co-signs and broadcasts client-supplied EVM transactions without validating that the client-supplied gas_limit is sufficient to complete execution, allowing an unauthenticated remote attacker to repeatedly submit transactions that revert out-of-gas at no financial cost to the attacker, draining the fee-payer wallet and denying gas sponsorship to legitimate clients. Affected versions: - >= 0.2.0, < 0.6.0 We recommend updating to: 0.6.0. CVSS 8.2 · our assessment: this_week Vendor advisory: https://github.com/ZenHive/mpp/security/advisories/GHSA-vj8p-hp9x-gh47 Details: https://vuln.today/cve/CVE-2026-59252