Improper input validation in the ZenHive mpp Elixir library (CVE-2026-59695)

CVE-2026-59695 is an improper input validation vulnerability in the ZenHive mpp Elixir library whereby `cosign_fee_payer/3` in transaction.ex co-signs client-supplied `max_fee_per_gas` and `max_priority_fee_per_gas` fields from the 0x76 AASigned envelope verbatim, without validating that those values are within reasonable bounds. An unauthenticated remote client can embed arbitrarily large gas price values in the signed envelope; the server co-signs and broadcasts the transaction, paying those inflated gas costs from its own fee-payer wallet. A single crafted request is sufficient to drain the wallet entirely, after which the server can no longer sponsor gas for legitimate clients, resulting in both direct financial loss and denial of service. Affected versions: - >= 0.2.0, < 0.6.0 We recommend updating to: 0.6.0. CVSS 8.3 · our assessment: this_week Vendor advisory: https://github.com/ZenHive/mpp/security/advisories/GHSA-vv77-66rf-pm86 Details: https://vuln.today/cve/CVE-2026-59695