{"schema_version":"2","view":"grouped","data":[{"id":3233,"cve_ids":["CVE-2026-48100"],"payload":{"kind":"advisory","title":"Payy: agg_agg trailing message slots are unconstrained and allow forged burn messages","summary":"Payy is an Ethereum L2 zk-rollup for privacy preserving and regulatory compliant transactions. Prior to version 1.3.0, agg_agg forwards the compacted message stream from its inner proofs into a public messages: [Field; 1000] array, but it never checks that the unused tail of the outer array is zero. A registered prover can build a valid agg_final proof for an approved rollup block while inserting an extra burn message after the real messages. RollupV1.verifyRollup() then parses that public input as a normal burn and transfers USDC from the rollup contract to the attacker. This is a severe circuit soundness failure: the proof system accepts a public statement whose messages array is not fully derived from the verified inner proofs. On the current deployment, verifyRollup() is restricted to the existing allowlisted prover, so a fresh public caller cannot submit the invalid proof directly. That gate limits who can reach L1 today; it does not make the circuit statement sound. The issue becomes permissionless under the prover model described in the Payy whitepaper. Section 3.3.2 states: \"To join as a prover, the prover is required to submit a small stake\", and Section 3.3.1 states that if a prover fails to submit, \"other nodes can submit the block proof instead.\" In that model, an attacker only needs to become a registered prover and use public validator approval data for an already approved block. This issue has been patched in version 1.3.0.","evidence":"cve:CVE-2026-48100","products":[{"name":{"value":"payy","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-48100","aliases":["CVE-2026-48100"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"affected":[{"vendor":"polybase","product":"payy","versions":[{"status":"affected","version":"< 1.3.0"}]}],"modified":"2026-09-28T17:27:18.467Z","provider":"cve","references":["https://github.com/polybase/payy/security/advisories/GHSA-fhxc-63vg-9gwr"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-48100","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T17:20:42.562536Z"}}}],"references":[{"url":"https://github.com/polybase/payy/security/advisories/GHSA-fhxc-63vg-9gwr","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T17:27:18.467Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-28T16:43:06.401Z"}}},"related_cves":[{"value":"CVE-2026-48100","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3138ed10-305e-408d-8362-9f6276ee2170","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-48100","advisory_id":"3138ed10-305e-408d-8362-9f6276ee2170","event_types":["advisory"],"published_at":"2026-10-24T21:31:44.715522+00:00","technologies":["core-cve","payy"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T16:43:06.401+00:00","detail_url":"/advisories/advisory%3A3138ed10-305e-408d-8362-9f6276ee2170","group":{"id":"advisory:3138ed10-305e-408d-8362-9f6276ee2170","revision":1,"primary_event_id":3245,"change":"published","superseded_by":[],"changed":{"id":3245,"cve_ids":["CVE-2026-48100"],"payload":{"kind":"advisory","title":"Payy: agg_agg trailing message slots are unconstrained and allow forged burn messages","summary":"Payy is an Ethereum L2 zk-rollup for privacy preserving and regulatory compliant transactions. Prior to version 1.3.0, agg_agg forwards the compacted message stream from its inner proofs into a public messages: [Field; 1000] array, but it never checks that the unused tail of the outer array is zero. A registered prover can build a valid agg_final proof for an approved rollup block while inserting an extra burn message after the real messages. RollupV1.verifyRollup() then parses that public input as a normal burn and transfers USDC from the rollup contract to the attacker. This is a severe circuit soundness failure: the proof system accepts a public statement whose messages array is not fully derived from the verified inner proofs. On the current deployment, verifyRollup() is restricted to the existing allowlisted prover, so a fresh public caller cannot submit the invalid proof directly. That gate limits who can reach L1 today; it does not make the circuit statement sound. The issue becomes permissionless under the prover model described in the Payy whitepaper. Section 3.3.2 states: \"To join as a prover, the prover is required to submit a small stake\", and Section 3.3.1 states that if a prover fails to submit, \"other nodes can submit the block proof instead.\" In that model, an attacker only needs to become a registered prover and use public validator approval data for an already approved block. This issue has been patched in version 1.3.0.","evidence":"cve:CVE-2026-48100","products":[{"name":{"value":"payy","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-48100","aliases":["CVE-2026-48100"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"affected":[{"vendor":"polybase","product":"payy","versions":[{"status":"affected","version":"< 1.3.0"}]}],"modified":"2026-09-28T17:27:18.467Z","provider":"cve","references":["https://github.com/polybase/payy/security/advisories/GHSA-fhxc-63vg-9gwr"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-48100","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T17:20:42.562536Z"}}}],"references":[{"url":"https://github.com/polybase/payy/security/advisories/GHSA-fhxc-63vg-9gwr","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T17:27:18.467Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-28T16:43:06.401Z"}}},"related_cves":[{"value":"CVE-2026-48100","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3138ed10-305e-408d-8362-9f6276ee2170","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-48100","advisory_id":"3138ed10-305e-408d-8362-9f6276ee2170","event_types":["advisory"],"published_at":"2026-10-24T21:31:44.715522+00:00","technologies":["core-cve","payy"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T16:43:06.401+00:00","detail_url":"/events/3245"},"members":[{"id":3245,"cve_ids":["CVE-2026-48100"],"payload":{"kind":"advisory","title":"Payy: agg_agg trailing message slots are unconstrained and allow forged burn messages","summary":"Payy is an Ethereum L2 zk-rollup for privacy preserving and regulatory compliant transactions. Prior to version 1.3.0, agg_agg forwards the compacted message stream from its inner proofs into a public messages: [Field; 1000] array, but it never checks that the unused tail of the outer array is zero. A registered prover can build a valid agg_final proof for an approved rollup block while inserting an extra burn message after the real messages. RollupV1.verifyRollup() then parses that public input as a normal burn and transfers USDC from the rollup contract to the attacker. This is a severe circuit soundness failure: the proof system accepts a public statement whose messages array is not fully derived from the verified inner proofs. On the current deployment, verifyRollup() is restricted to the existing allowlisted prover, so a fresh public caller cannot submit the invalid proof directly. That gate limits who can reach L1 today; it does not make the circuit statement sound. The issue becomes permissionless under the prover model described in the Payy whitepaper. Section 3.3.2 states: \"To join as a prover, the prover is required to submit a small stake\", and Section 3.3.1 states that if a prover fails to submit, \"other nodes can submit the block proof instead.\" In that model, an attacker only needs to become a registered prover and use public validator approval data for an already approved block. This issue has been patched in version 1.3.0.","evidence":"cve:CVE-2026-48100","products":[{"name":{"value":"payy","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-48100","aliases":["CVE-2026-48100"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"affected":[{"vendor":"polybase","product":"payy","versions":[{"status":"affected","version":"< 1.3.0"}]}],"modified":"2026-09-28T17:27:18.467Z","provider":"cve","references":["https://github.com/polybase/payy/security/advisories/GHSA-fhxc-63vg-9gwr"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-48100","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T17:20:42.562536Z"}}}],"references":[{"url":"https://github.com/polybase/payy/security/advisories/GHSA-fhxc-63vg-9gwr","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T17:27:18.467Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-28T16:43:06.401Z"}}},"related_cves":[{"value":"CVE-2026-48100","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3138ed10-305e-408d-8362-9f6276ee2170","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-48100","advisory_id":"3138ed10-305e-408d-8362-9f6276ee2170","event_types":["advisory"],"published_at":"2026-10-24T21:31:44.715522+00:00","technologies":["core-cve","payy"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T16:43:06.401+00:00","detail_url":"/events/3245"}]}}],"next_after":3233,"next_before":3233}