Open-source package vulnerability · Rust (crates.io)

GHSA-fxc9-7j2w-vx54: mpp has multiple payment bypass and griefing vulnerabilities

criticalCVSS 4.0 9.3

Impact Multiple vulnerabilities were discovered which allowed for undesirable behaviors, including: - Performing free tempo/charge requests - Replaying existing tempo/charge requests - Performing free tempo/session requests - Piggybacking off existing tempo/session channels - Griefing existing tempo/session channels - Manipulate the fee payer of a tempo/charge or tempo/session handler into paying for requests -…

Published Mar 29, 2026 · Updated Apr 1, 2026

Affected packages

mpp

Ecosystem: Rust (crates.io)
Affected: < 0.8.0
Fixed in: 0.8.0
Check: cargo tree -i mpp

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Impact

Multiple vulnerabilities were discovered which allowed for undesirable behaviors, including:

Performing free tempo/charge requests
Replaying existing tempo/charge requests
Performing free tempo/session requests
Piggybacking off existing tempo/session channels
Griefing existing tempo/session channels
Manipulate the fee payer of a tempo/charge or tempo/session handler into paying for requests
Replaying existing stripe/charge requests

Patches

The issues are patched in 0.8.0

Workarounds

There are no workarounds available for these vulnerabilities

Credited to samczsun, veria-labs.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology