CVE-2026-34209: mppx: Tempo has a session close voucher bypass vulnerability due to settled amount equality

March 29, 2026 (updated March 31, 2026)

The tempo/session cooperative close handler validated the close voucher amount using < instead of <= against the on-chain settled amount. An attacker could submit a close voucher exactly equal to the settled amount, which would be accepted without committing any new funds, effectively closing or griefing the channel for free.

References

github.com/advisories/GHSA-mv9j-8jvg-j8mr
github.com/wevm/mppx
github.com/wevm/mppx/commit/94088246ee18f21b5d6be40d9e7a464f5a280bfb
github.com/wevm/mppx/releases/tag/mppx@0.4.11
github.com/wevm/mppx/security/advisories/GHSA-mv9j-8jvg-j8mr
nvd.nist.gov/vuln/detail/CVE-2026-34209

Code Behaviors & Features

Detect and mitigate CVE-2026-34209 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →