Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

High severity, published 25 September 2026.

Is there a fix for This vulnerability?

A patch was published on 2026-06-24: Version 0.6.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run ZenHive Mpp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

ZenHive mpp input validation bypass in fee-payer cosigning

Severity: high · Published 2026-09-25

mpp is a library used by blockchain servers that co-sign cryptocurrency transactions on behalf of clients. A malicious client can submit a transaction with arbitrarily inflated gas fees, which the server will approve and broadcast, draining the server's cryptocurrency wallet to pay the inflated fees. This results in direct financial loss and, if the wallet is completely drained, causes the server to reject all legitimate transaction requests, creating a denial of service.

Technologies: ZenHive Mpp. Vendors: ZenHive.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: High severity, published 25 September 2026.
Which products and versions are affected?: ZenHive Mpp 0.2.0 to 0.5.x.
Is there a fix for This vulnerability?: A patch was published on 2026-06-24: Version 0.6.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run ZenHive Mpp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The cosign_fee_payer/3 function in transaction.ex fails to validate gas_limit, max_fee_per_gas, and max_priority_fee_per_gas parameters before co-signing a fee-payer transaction. An attacker can embed arbitrarily large values for max_fee_per_gas and max_priority_fee_per_gas in the signed envelope, causing the server to pay inflated gas costs from its own wallet when the effective_gas_price is calculated. The vulnerability affects mpp versions 0.2.0 through 0.5.x and was patched in version 0.6.0.

Affected products

ZenHive mpp 0.2.0 to 0.5.x

Timeline

2026-06-24: disclosed
2026-06-24: patched: Version 0.6.0

References

https://api.github.com/users/kai-kka

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.