Improper Validation Vulnerability in ZenHive mpp Product

CVE-2026-59694

What is CVE-2026-59694?

The vulnerability in ZenHive mpp allows unauthenticated remote clients to exploit improper validation of input fields, particularly affecting the gas cost incurred by fee payers. When configured to pay fees, the mpp library fails to validate the EIP-2930 access list entries provided by clients. This can lead to substantial increases in gas costs for transactions as clients can submit a valid transfer alongside false entries that dramatically inflate the expenses. Sustained exploitation could severely impact operating margins for sponsors, leading to potential financial loss and drain on fee-payer wallets.

References