CVE-2026-88255 mpp Tempo keys its pre-broadcast dedup reserve on the caller-supplied transaction encoding, so a re-encoded signed transaction reserves a second slot

[
  {
    "collectionURL": "https://repo.hex.pm",
    "cpes": [
      "cpe:2.3:a:ZenHive:mpp:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "'Elixir.MPP.Methods.Tempo'"
    ],
    "packageName": "mpp",
    "packageURL": "pkg:hex/mpp",
    "product": "mpp",
    "programFiles": [
      "lib/mpp/methods/tempo.ex"
    ],
    "programRoutines": [
      {
        "name": "'Elixir.MPP.Methods.Tempo':verify/2"
      }
    ],
    "repo": "https://github.com/ZenHive/mpp",
    "vendor": "ZenHive",
    "versions": [
      {
        "lessThan": "0.16.2",
        "status": "affected",
        "version": "0.2.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://github.com",
    "cpes": [
      "cpe:2.3:a:ZenHive:mpp:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "'Elixir.MPP.Methods.Tempo'"
    ],
    "packageName": "zenhive/mpp",
    "packageURL": "pkg:github/zenhive/mpp",
    "product": "mpp",
    "programFiles": [
      "lib/mpp/methods/tempo.ex"
    ],
    "programRoutines": [
      {
        "name": "'Elixir.MPP.Methods.Tempo':verify/2"
      }
    ],
    "repo": "https://github.com/ZenHive/mpp",
    "vendor": "ZenHive",
    "versions": [
      {
        "lessThan": "e12bd4a1cea2e97c2a01fc059c48e5594a7b4a43",
        "status": "affected",
        "version": "f8904666061fbab695874856d8fcd02c471dfe1b",
        "versionType": "git"
      }
    ]
  }
]