CVE-2026-73541 ZenHive CVE debrief

Who should care

Defenders responsible for ZenHive Machine Payments Protocol deployments should assess exposure and prioritize patching or compensating controls. They should verify if their deployment is within the affected version range (0.2.0 to 0.12.0) and implement measures to mitigate the vulnerability. Additionally, defenders should review and update incident response plans to address potential denial of service and conduct regular security audits to identify and

Why it matters

CVE-2026-73541 allows unauthenticated remote clients to drain the fee-payer wallet in ZenHive Machine Payments Protocol, causing denial of service to legitimate payers. Defenders should verify exposure, assess compensating controls, and prioritize patching.

• Denial of service to legitimate payers once the fee-payer wallet is empty.
• Potential financial loss due to concurrent sponsored payments.
• Need for verification of affected versions and exposure in the environment.
• Priority for patching or applying compensating controls.

Technical summary

The Machine Payments Protocol (mpp) library does not enforce limits on concurrent sponsored payments, allowing an unauthenticated remote client to drain the fee-payer wallet by sending multiple transactions with distinct expiring nonces. This issue arises because the library only enforces ceilings against one transaction at a time and does not account for exposure across concurrent requests. The default 900-second validity window lets co-signed transactions stay broadcastable and uncounted for that entire period, further exacerbating the vulnerability.

Defensive priority

Defenders should prioritize verifying exposure and assessing compensating controls for unpatched Machine Payments Protocol instances.

Recommended defensive actions

• Verify if your deployment of Machine Payments Protocol is within the affected version range (0.2.0 to 0.12.0).
• Assess the feasibility of concurrent sponsored payments in your environment.
• Implement compensating controls to monitor and limit sponsored payment transactions.
• Apply the patch (ddc46868fba57ccebb567c04709812b466123076) or upgrade to version 0.12.0 or later.
• Review and update incident response plans to address potential denial of service.
• Conduct regular security audits to identify and mitigate similar vulnerabilities.
• Engage with the vendor for additional guidance and support.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, which affects Machine Payments Protocol (mpp) versions from 0.2.0 before 0.12.0. The vulnerability allows unauthenticated remote clients to drain the fee-payer wallet through concurrent sponsored payments. Defenders should verify exposure, assess compensating controls, and prioritize patching. The issue is caused by the library's failure to account for exposure across concurrent requests, allowing committed sponsor exposure to be N times max_total_fee. The default 900-

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.