CVE-2026-34209highCWE-294

CVE-2026-34209: falha de alta gravidade em wevm mppx

mppx: Tempo has a session close voucher bypass vulnerability due to settled amount equality

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar mppx+ Monitorar mppx

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.4%
mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the tempo/session cooperative close handler validated the close voucher amount using "<" instead of "<=" against the on-chain settled amount. An attacker could submit a close voucher exactly equal to the settled amount, which would be accepted without committing any new funds, effectively closing or griefing the channel for free. This issue has been patched in version 0.4.11.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Produtos afetados
wevm · mppx
CVEs relacionadas — wevm mppx

No mesmo produto, das mais perigosas para as menos.

CVE-2026-63627MEDIUMmppx: Gas Draining with paddingEPSS 0.5%CVE-2026-34210MEDIUMmppx has Stripe charge credential replay via missing idempotency checkEPSS 0.5%CVE-2026-63628MEDIUMmppx: Gas Draining with access listEPSS 0.5%