Vulnerability in pympp Python SDK for Machine Payments Protocol
CVE-2026-63634

6.9MEDIUM

Key Information:

Vendor

Tempoxyz

Status
Pympp
Vendor
CVE Published:
9 November 2026

What is CVE-2026-63634?

The pympp Python SDK for the Machine Payments Protocol has a vulnerability where, before version 0.9.1, the server fails to adequately validate calldata when acting as the fee payer. This leniency in eth_abi decoding allows harmful manipulation where attackers can append trailing data, inflating gas consumption without breaching gas limit or fee caps. This flaw enables malicious users to drain the fee-payer’s wallet through padded transactions. The issue has been addressed in version 0.9.1.

Affected Version(s)

pympp < 0.9.1

References

https://github.com/tempoxyz/pympp/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/tempoxyz/pympp/commit/57a750d0d980b8e6...
x_refsource_MISC
https://github.com/tempoxyz/pympp/releases/tag/v0.9.1
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.