https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 23:03:19 +0000 https://db.gcve.eu/vuln/cve-2026-82750 <p><strong>Affected:</strong> ZenHive mpp</p> <p>Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer&#39;s gas cost per sponsored payment by a large multiplier and to have the sponsor pay for EIP-7702 account delegations of the client&#39;s choosing.</p> <p>When the server sponsors Tempo payments, MPP.Methods.Tempo.FeePayerPolicy.measure/3 in lib/mpp/methods/tempo/fee_payer_policy.ex bounds the gas fields, the fee budget, the validity window and the access list of the client-signed 0x76 envelope, but never reads its aa_authorization_list field. Every signed delegation in that list is charged as intrinsic gas before the payment call runs, so a client attaching delegations from throwaway authority keys makes the sponsor pay for them within the default gas_limit ceiling. At the reporter&#39;s default of seven entries the sponsored cost rises from about 46,575 gas to about 1,884,087 gas. Because each entry is applied as a persistent set-code delegation, a client can also upgrade its own accounts to delegated code at the sponsor&#39;s expense.</p> <p>This issue affects mpp: from 0.2.0 before 0.16.1.</p> <p><strong>Affected:</strong> ZenHive mpp</p> <p>Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer&#39;s gas cost per sponsored payment by a large multiplier and to have the sponsor pay for EIP-7702 account delegations of the client&#39;s choosing.</p> <p>When the server sponsors Tempo payments, MPP.Methods.Tempo.FeePayerPolicy.measure/3 in lib/mpp/methods/tempo/fee_payer_policy.ex bounds the gas fields, the fee budget, the validity window and the access list of the client-signed 0x76 envelope, but never reads its aa_authorization_list field. Every signed delegation in that list is charged as intrinsic gas before the payment call runs, so a client attaching delegations from throwaway authority keys makes the sponsor pay for them within the default gas_limit ceiling. At the reporter&#39;s default of seven entries the sponsored cost rises from about 46,575 gas to about 1,884,087 gas. Because each entry is applied as a persistent set-code delegation, a client can also upgrade its own accounts to delegated code at the sponsor&#39;s expense.</p> <p>This issue affects mpp: from 0.2.0 before 0.16.1.</p> https://db.gcve.eu/vuln/cve-2026-82750