CVE-2026-73541 - Tempo fee sponsorship in mpp bounds each transaction but not aggregate exposure, allowing concurrent sponsor-wallet drain
Brief
CVE ID : CVE-2026-73541
Published : Aug. 19, 2026, 6:17 p. m.
- 51 minutes ago
Description : Allocation of Resources Without Limits or Throttling in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet through concurrent sponsored payments, denying service to legitimate payers once it is empty.
MPP. Methods. Tempo. FeePayerPolicy enforces its ceilings (max_gas, max_fee_per_gas, max_priority_fee_per_gas, the worst-case gas_limit * max_fee_per_gas Severity: 8. 3
- HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...