CVE-2026-73541 Tempo fee sponsorship in mpp bounds each transaction but not aggregate exposure, allowing concurrent sponsor-wallet drain

Allocation of Resources Without Limits or Throttling in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet through concurrent sponsored payments, denying service to legitimate payers once it is empty. MPP.Methods.Tempo.FeePayerPolicy enforces its ceilings maxgas,...

CVE-2026-73541

CVE-2026-73541 is a resource-exhaustion flaw in ZenHive mpp (Erlang Tempo MPP library), versions 0.2.0 through before 0.12.0 . The MPP.Methods.Tempo.FeePayerPolicy enforces per-transaction fee ceilings but imposes no aggregate cap across concurrent requests. An unauthenticated remote client can s...