Quick answers
- Is CVE-2026-59252 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-59252 being exploited in the wild.
- How severe is CVE-2026-59252?
- Informational severity, with a CVSS score of 8.2, published 17 July 2026.
- Which products and versions are affected?
- ZenHive Mpp from 0.2.0 before 0.6.0.
- Is there a fix for CVE-2026-59252?
- A patch was published on 2026-06-24: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-59252 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-59252?
- Check whether you run ZenHive Mpp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in the MPP.Methods.Tempo payment method when configured with fee_payer: true. The library co-signs and broadcasts client-supplied EVM transactions without validating that the gas_limit is sufficient for the transaction to succeed. An attacker can provide a gas_limit slightly below the required threshold, causing the transaction to revert after consuming gas; the fee-payer wallet is charged for this burned gas while the attacker incurs no cost. The issue also affects the 'optimistic' path (wait_for_confirmation = false) because its simulation via eth_call omits the gas parameter, failing to detect out-of-gas conditions. A fix is available in version 0.6.0.
Affected products
- ZenHive mpp from 0.2.0 before 0.6.0
Timeline
- 2026-06-24: patched: Fix committed to repository
- 2026-07-17: advisory: NVD and CNA advisory published