ZenHive mpp CVE-2026-59252

The server must be deployed as a Tempo fee payer with fee_payer: true and using the MPP.Methods.Tempo payment method on mpp versions 0.2.0 through 0.5.x; the attacker submits a validly client-signed transferWithMemo (0x76 envelope) EVM transaction with gas_limit deliberately set just below the amount required for the call to complete, which the server co-signs and broadcasts via rpc_broadcast_sync (the optimistic wait_for_confirmation = false path is also affected because its eth_call simulation omits the gas parameter). No authentication is required (PR:N) and no user interaction is needed (UI:N). Exploitation is limited to sponsor deployments only - installations not acting as fee payer, not using the Tempo method, or already on 0.6.0+ are not affected - and the attacker must be able to compute and set a gas_limit precisely below the execution threshold for the intended call (the AT:P attack requirement).

The vendor CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N scores 8.2 (High) and is internally consistent with the description: network-reachable (AV:N), unauthenticated (PR:N), no user interaction (UI:N), a present attack requirement (AT:P - the server must be running as a Tempo fee payer and the attacker must tune gas_limit just below the execution threshold), and impact confined to availability (VA:H) with no confidentiality or integrity effect. No EPSS score was provided, and KEV status is not listed, so there is no evidence of active exploitation - treat exploitation likelihood as unquantified rather than low. There is no public exploit identified at time of analysis. The real-world priority is moderate and highly conditional: it is only a concern for the specific subset of operators who run mpp as a gas sponsor, but for those operators the economic-DoS impact is direct and cheap for the attacker, making prompt patching worthwhile. The main uncertainty is the affected product's small deployment footprint, which limits aggregate risk despite the high per-instance severity.

A server running mpp 0.2.0-0.5.x as a Tempo fee payer exposes its sponsored-payment endpoint to the network. An unauthenticated attacker crafts and signs a transferWithMemo (0x76) transaction with gas_limit set just below the amount needed to complete, submits it, and the server co-signs and broadcasts it; the transaction runs out of gas and reverts on-chain while the sponsor wallet is charged for the burned gas. Repeating this in a loop from one or more clients drains the fee-payer wallet at near-zero cost to the attacker until the server can no longer sponsor gas for legitimate users. No public exploit code is identified, but the attack requires only a standard signed EVM transaction with a deliberately low gas limit.