{"id":"CVE-2026-63634","published":"2026-11-09T22:18:53.803","lastModified":"2026-11-09T22:18:53.803","description":"pympp is a Python SDK for the Machine Payments Protocol. Prior to version 0.9.1, when the server acts as the fee_payer, pympp validates calldata using eth_abi decoding, which is lenient about trailing bytes. The FeePayerPolicy caps gas_limit (≤ 2 M) and max_fee_per_gas (≤ 100 Gwei) but does not check calldata length. Tempo uses legacy calldata gas pricing: 16 gas per non-zero byte. Appending N bytes of 0x01 padding inflates actual gas used by N × 16 while keeping gas_limit and max_fee_per_gas within policy caps. The server cosigns and broadcasts the padded transaction, draining its fee-payer wallet. This issue has been patched in version 0.9.1.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-20"],"vendors":[],"products":[],"references":[{"url":"https://github.com/tempoxyz/pympp/commit/57a750d0d980b8e6c3bea62a40b7621f176ff1f0","tags":[]},{"url":"https://github.com/tempoxyz/pympp/releases/tag/v0.9.1","tags":[]},{"url":"https://github.com/tempoxyz/pympp/security/advisories/GHSA-v858-xh7w-8jr5","tags":[]}],"exploitRefs":[{"url":"https://github.com/tempoxyz/pympp/commit/57a750d0d980b8e6c3bea62a40b7621f176ff1f0","tags":[]},{"url":"https://github.com/tempoxyz/pympp/releases/tag/v0.9.1","tags":[]},{"url":"https://github.com/tempoxyz/pympp/security/advisories/GHSA-v858-xh7w-8jr5","tags":[]}],"hasPoc":true,"ai":null}