CVE-2026-63627: mppx: Gas Draining with padding

September 22, 2026

A malicious client can force the server to pay ~5x the normal transaction fee. This dramatically increases operational costs and completely destroys the profit margin on low-cost items.

Please provide a way to share the PoC in .zip format to you. Thank you!

References

github.com/advisories/GHSA-727h-3vm5-qwq6
github.com/wevm/mppx/commit/24ddcca719ae282977d8747309ed1275ea282b25
github.com/wevm/mppx/pull/602
github.com/wevm/mppx/releases/tag/mppx@0.8.2
github.com/wevm/mppx/security/advisories/GHSA-727h-3vm5-qwq6
nvd.nist.gov/vuln/detail/CVE-2026-63627

Code Behaviors & Features

Detect and mitigate CVE-2026-63627 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →