CVE-2026-63634

UNKNOWN 0.0

pympp: Gas Draining with padding

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

pympp is a Python SDK for the Machine Payments Protocol. Prior to version 0.9.1, when the server acts as the fee_payer, pympp validates calldata using eth_abi decoding, which is lenient about trailing bytes. The FeePayerPolicy caps gas_limit (≤ 2 M) and max_fee_per_gas (≤ 100 Gwei) but does not check calldata length. Tempo uses legacy calldata gas pricing: 16 gas per non-zero byte. Appending N bytes of 0x01 padding inflates actual gas used by N × 16 while keeping gas_limit and max_fee_per_gas within policy caps. The server cosigns and broadcasts the padded transaction, draining its fee-payer wallet. This issue has been patched in version 0.9.1.

CWE	CWE-20
Vendor	tempoxyz
Product	pympp
Published	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for tempoxyz pympp

Be the first to know when new unknown vulnerabilities affecting tempoxyz pympp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

tempoxyz / pympp

< 0.9.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/tempoxyz/pympp/security/advisories/GHSA-v858-xh7w-8jr5 github.com: https://github.com/tempoxyz/pympp/commit/57a750d0d980b8e6c3bea62a40b7621f176ff1f0 github.com: https://github.com/tempoxyz/pympp/releases/tag/v0.9.1