mpp (Hex)
Advisories
16
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 0.16.2 or later clears every advisory below that has a fix.
Upgrade commands
mix
{:mpp, "~> 0.16.2"} # then: mix deps.update mppKnown vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| EEF-CVE-2026-87119 mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayed |
Not rated yet EPSS 0.57% |
>= 0.14.0, < 0.16.2 | 0.16.2 |
| EEF-CVE-2026-89420 Session voucher adding no new funds is accepted without a charge in mpp, serving paid resources for free |
Not rated yet EPSS 0.41% |
>= 0.14.0, < 0.16.2 | 0.16.2 |
| EEF-CVE-2026-88255 mpp Tempo keys its pre-broadcast dedup reserve on the caller-supplied transaction encoding, so a re-encoded signed transaction reserves a second slot |
Not rated yet EPSS 0.52% |
>= 0.2.0, < 0.16.2 | 0.16.2 |
| EEF-CVE-2026-89186 mpp writes Payment-Receipt and Cache-Control before the wrapped application runs, letting a consumer's own Cache-Control expose paid responses to shared caches |
Not rated yet EPSS 0.52% |
>= 0.1.0, < 0.16.2 | 0.16.2 |
| EEF-CVE-2026-82750 Unbounded EIP-7702 authorization list in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors account delegation |
Not rated yet EPSS 0.52% |
>= 0.2.0, < 0.16.1 | 0.16.1 |
| EEF-CVE-2026-82751 Unbounded key authorization in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors access-key provisioning |
Not rated yet EPSS 0.52% |
>= 0.2.0, < 0.16.1 | 0.16.1 |
| EEF-CVE-2026-67581 On-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challenge replay |
High EPSS 0.60% |
>= 0.3.0, < 0.6.3 | 0.6.3 |
| EEF-CVE-2026-73541 Tempo fee sponsorship in mpp bounds each transaction but not aggregate exposure, allowing concurrent sponsor-wallet drain |
High EPSS 0.59% |
>= 0.2.0, < 0.12.0 | 0.12.0 |
| EEF-CVE-2026-73136 Static memo configuration in mpp Tempo disables per-challenge attribution binding, enabling third-party replay |
High EPSS 0.60% |
>= 0.6.1, < 0.6.4 | 0.6.4 |
| EEF-CVE-2026-73829 Non-atomic hash-credential dedup in mpp Tempo allows replay of a confirmed payment under a concurrent race |
Low EPSS 0.32% |
>= 0.2.0, < 0.6.1 | 0.6.1 |
| EEF-CVE-2026-59252 Missing gas_limit validation in mpp Tempo fee-payer enables wallet drain |
High EPSS 0.46% |
>= 0.2.0, < 0.6.0 | 0.6.0 |
| EEF-CVE-2026-59252 Missing gas_limit validation in mpp Tempo fee-payer enables wallet drain |
High EPSS 0.46% |
>= 0.2.0, < 0.6.0 | 0.6.0 |
| EEF-CVE-2026-59694 Unbounded access list in mpp Tempo fee-payer inflates gas cost per payment |
Medium EPSS 0.52% |
>= 0.2.0, < 0.6.0 | 0.6.0 |
| EEF-CVE-2026-59694 Unbounded access list in mpp Tempo fee-payer inflates gas cost per payment |
Medium EPSS 0.52% |
>= 0.2.0, < 0.6.0 | 0.6.0 |
| EEF-CVE-2026-59695 Unbounded max_fee_per_gas in mpp Tempo fee-payer enables single-request wallet drain |
High EPSS 0.52% |
>= 0.2.0, < 0.6.0 | 0.6.0 |
| EEF-CVE-2026-59695 Unbounded max_fee_per_gas in mpp Tempo fee-payer enables single-request wallet drain |
High EPSS 0.52% |
>= 0.2.0, < 0.6.0 | 0.6.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor