{"affected":[{"product":"pympp","source":"CNA: GitHub_M","vendor":"tempoxyz","versions":[{"status":"affected","version":"< 0.9.1"}]}],"cveId":"CVE-2026-63634","cwes":["CWE-20"],"description":"pympp is a Python SDK for the Machine Payments Protocol. Prior to version 0.9.1, when the server acts as the fee_payer, pympp validates calldata using eth_abi decoding, which is lenient about trailing bytes. The FeePayerPolicy caps gas_limit (≤ 2 M) and max_fee_per_gas (≤ 100 Gwei) but does not check calldata length. Tempo uses legacy calldata gas pricing: 16 gas per non-zero byte. Appending N bytes of 0x01 padding inflates actual gas used by N × 16 while keeping gas_limit and max_fee_per_gas within policy caps. The server cosigns and broadcasts the padded transaction, draining its fee-payer wallet. This issue has been patched in version 0.9.1.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.9,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1794257995768,"publishedAt":1794257995768,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/tempoxyz/pympp/security/advisories/GHSA-v858-xh7w-8jr5"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tempoxyz/pympp/commit/57a750d0d980b8e6c3bea62a40b7621f176ff1f0"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tempoxyz/pympp/releases/tag/v0.9.1"}],"remediation":[],"revision":"b7cfda8abd4dc40b902a22aa61c675a345d109a202b046f26d56986b90feba04","sources":[{"modifiedAt":1794257995768,"name":"CNA: GitHub_M","retrievedAt":1794258609703,"url":"https://www.cve.org/CVERecord?id=CVE-2026-63634"}],"ssvc":null,"status":"published","title":"pympp: Gas Draining with padding","updatedAt":1794258609703}