CVE-2026-63628: mppx: Gas Draining with access list

September 22, 2026

A malicious client can force the server to pay ~9.4x the normal transaction fee. This dramatically increases operational costs and completely destroys the profit margin on low-cost items.

References

github.com/advisories/GHSA-vc9j-9wph-qghj
github.com/wevm/mppx/commit/24ddcca719ae282977d8747309ed1275ea282b25
github.com/wevm/mppx/pull/602
github.com/wevm/mppx/releases/tag/mppx@0.8.2
github.com/wevm/mppx/security/advisories/GHSA-vc9j-9wph-qghj
nvd.nist.gov/vuln/detail/CVE-2026-63628

Code Behaviors & Features

Detect and mitigate CVE-2026-63628 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →