CVE-2026-63634

Name of the Vulnerable Software and Affected Versions pympp versions prior to 0.9.1

Description When the server operates as the fee payer, the software validates calldata using eth abi decoding, which does not strictly handle trailing bytes. While the FeePayerPolicy limits gas limit and max fee per gas, it fails to verify the calldata length. An attacker can append padding bytes (0x01) to inflate the actual gas used, as Tempo employs legacy calldata gas pricing of 16 gas per non-zero byte. This allows the server to cosign and broadcast padded transactions that exceed intended costs, leading to the depletion of the fee-payer wallet.

Recommendations Update to version 0.9.1.