Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-114663 (GCVE-0-2026-114663)

Vulnerability from nvd – Published: 2026-10-22 01:43 – Updated: 2026-10-23 15:06

Title

Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments

Summary

Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name, attacker-influenced input can replace the intended value, including out-of-range values for narrow types such as uint8, corrupting validation or accounting logic.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.4 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-23 14:54 UTC

CWE

CWE-706 - Use of Incorrectly-Resolved Name or Reference

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6775 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/vyperlang/vyper/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/vyper-0.4-0b…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
vyperlang	vyper	Affected: 0.4.0b1 , ≤ 0.5.0b1 (python) cpe:2.3:a:vyperlang:vyper::::::::

Date Public

2026-10-07 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-114663",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-23T14:54:17.794694Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-23T15:06:28.237Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/vyper",
          "product": "vyper",
          "vendor": "vyperlang",
          "versions": [
            {
              "lessThanOrEqual": "0.5.0b1",
              "status": "affected",
              "version": "0.4.0b1",
              "versionType": "python"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "0.5.0b1",
                  "versionStartIncluding": "0.4.0b1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-10-07T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function\u0027s scope rather than at declaration. When a contract\u0027s parameter, local, or loop variable shares such a name, attacker-influenced input can replace the intended value, including out-of-range values for narrow types such as uint8, corrupting validation or accounting logic."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-706",
              "description": "Use of Incorrectly-Resolved Name or Reference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T01:43:46.942Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-2489-32vh-8rrc)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-2489-32vh-8rrc"
        },
        {
          "name": "VulnCheck Advisory: Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/vyper-0.4-0b1-through-0.5-0b1-name-shadowing-of-imported-constants-and-default-arguments"
        }
      ],
      "title": "Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-114663",
    "datePublished": "2026-10-22T01:43:46.942Z",
    "dateReserved": "2026-10-21T21:59:05.257Z",
    "dateUpdated": "2026-10-23T15:06:28.237Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114118 (GCVE-0-2026-114118)

Vulnerability from nvd – Published: 2026-10-21 00:37 – Updated: 2026-10-21 00:37

Title

Vyper 0.3.4 through 0.5.0b1 create_from_blueprint Offset Validation Bypass via Unsigned Wraparound

Summary

Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by uint256 subtraction without first checking that code_offset is below the blueprint's code size, so a huge offset wraps to a small positive value. An attacker controlling code_offset can make a factory deploy contracts with no runtime code, potentially trapping ETH and tokens.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

CWE

CWE-681 - Incorrect Conversion between Numeric Types

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6775 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/vyperlang/vyper/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/vyper-0.3.4-…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
vyperlang	vyper	Affected: 0.3.4 , ≤ 0.5.0b1 (python) cpe:2.3:a:vyperlang:vyper::::::::

Date Public

2026-10-06 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/vyper",
          "product": "vyper",
          "vendor": "vyperlang",
          "versions": [
            {
              "lessThanOrEqual": "0.5.0b1",
              "status": "affected",
              "version": "0.3.4",
              "versionType": "python"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "0.5.0b1",
                  "versionStartIncluding": "0.3.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-10-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by uint256 subtraction without first checking that code_offset is below the blueprint\u0027s code size, so a huge offset wraps to a small positive value. An attacker controlling code_offset can make a factory deploy contracts with no runtime code, potentially trapping ETH and tokens."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-681",
              "description": "Incorrect Conversion between Numeric Types",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T00:37:15.454Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-fxg7-4wqg-c8gh)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-fxg7-4wqg-c8gh"
        },
        {
          "name": "VulnCheck Advisory: Vyper 0.3.4 through 0.5.0b1 create_from_blueprint Offset Validation Bypass via Unsigned Wraparound",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/vyper-0.3.4-through-0.5-0b1-create-from-blueprint-offset-validation-bypass-via-unsigned-wraparound"
        }
      ],
      "title": "Vyper 0.3.4 through 0.5.0b1 create_from_blueprint Offset Validation Bypass via Unsigned Wraparound",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-114118",
    "datePublished": "2026-10-21T00:37:15.454Z",
    "dateReserved": "2026-10-20T21:48:58.503Z",
    "dateUpdated": "2026-10-21T00:37:15.454Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114117 (GCVE-0-2026-114117)

Vulnerability from nvd – Published: 2026-10-21 00:37 – Updated: 2026-10-21 20:12

Title

Vyper 0.3.8 through 0.5.0b1 Optimizer Miscompilation of msg.value | K in Ternary Branches

Summary

Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas (the default) or -O codesize. Affected contracts use the wrong value in storage writes, arithmetic, indexes, return values, or events without warning or revert, which can record deposits incorrectly and lock funds.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-21 20:11 UTC

CWE

CWE-682 - Incorrect Calculation

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6775 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/vyperlang/vyper/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/vyper-0.3.8-…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
vyperlang	vyper	Affected: 0.3.8 , ≤ 0.5.0b1 (python) cpe:2.3:a:vyperlang:vyper::::::::

Date Public

2026-10-02 00:00

Credits

DELENE-TCHIO-ROMUALD

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-114117",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-21T20:11:58.758962Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-21T20:12:04.759Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-6j9c-gvcw-74fj"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/vyper",
          "product": "vyper",
          "vendor": "vyperlang",
          "versions": [
            {
              "lessThanOrEqual": "0.5.0b1",
              "status": "affected",
              "version": "0.3.8",
              "versionType": "python"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "0.5.0b1",
                  "versionStartIncluding": "0.3.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "DELENE-TCHIO-ROMUALD"
        }
      ],
      "datePublic": "2026-10-02T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas (the default) or -O codesize. Affected contracts use the wrong value in storage writes, arithmetic, indexes, return values, or events without warning or revert, which can record deposits incorrectly and lock funds."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-682",
              "description": "Incorrect Calculation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T00:37:14.741Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-6j9c-gvcw-74fj)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-6j9c-gvcw-74fj"
        },
        {
          "name": "VulnCheck Advisory: Vyper 0.3.8 through 0.5.0b1 Optimizer Miscompilation of msg.value | K in Ternary Branches",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/vyper-0.3.8-through-0.5-0b1-optimizer-miscompilation-of-msg-value-k-in-ternary-branches"
        }
      ],
      "title": "Vyper 0.3.8 through 0.5.0b1 Optimizer Miscompilation of msg.value | K in Ternary Branches",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-114117",
    "datePublished": "2026-10-21T00:37:14.741Z",
    "dateReserved": "2026-10-20T21:48:58.503Z",
    "dateUpdated": "2026-10-21T20:12:04.759Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114116 (GCVE-0-2026-114116)

Vulnerability from nvd – Published: 2026-10-21 00:37 – Updated: 2026-10-21 00:37

Title

Vyper through 0.5.0b1 Literal Value Manipulation via Line Separators

Summary

Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker contributing source code can hide these characters in comments, strings or indentation to silently change address, integer or decimal constants.

Severity

6 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

CWE

CWE-436 - Interpretation Conflict

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6775 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/vyperlang/vyper/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/vyper-throug…	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
vyperlang	vyper	Affected: 0.1.0b1 , < 0.1.0b17 (python) Unaffected: 0.1.0b17 (python)
vyperlang	vyper	Affected: 0.4.1 , ≤ 0.5.0b1 (python)

Date Public

2026-10-06 00:00

Credits

DELENE-TCHIO-ROMUALD

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/vyper",
          "product": "vyper",
          "vendor": "vyperlang",
          "versions": [
            {
              "lessThan": "0.1.0b17",
              "status": "affected",
              "version": "0.1.0b1",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "0.1.0b17",
              "versionType": "python"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/vyper",
          "product": "vyper",
          "vendor": "vyperlang",
          "versions": [
            {
              "lessThanOrEqual": "0.5.0b1",
              "status": "affected",
              "version": "0.4.1",
              "versionType": "python"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.1.0b17",
                  "versionStartIncluding": "0.1.0b1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "0.5.0b1",
                  "versionStartIncluding": "0.4.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "DELENE-TCHIO-ROMUALD"
        }
      ],
      "datePublic": "2026-10-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker contributing source code can hide these characters in comments, strings or indentation to silently change address, integer or decimal constants."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T00:37:13.988Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-wvx7-39qj-2g9v)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-wvx7-39qj-2g9v"
        },
        {
          "name": "VulnCheck Advisory: Vyper through 0.5.0b1 Literal Value Manipulation via Line Separators",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/vyper-through-0.5-0b1-literal-value-manipulation-via-line-separators"
        }
      ],
      "title": "Vyper through 0.5.0b1 Literal Value Manipulation via Line Separators",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-114116",
    "datePublished": "2026-10-21T00:37:13.988Z",
    "dateReserved": "2026-10-20T21:48:58.503Z",
    "dateUpdated": "2026-10-21T00:37:13.988Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114115 (GCVE-0-2026-114115)

Vulnerability from nvd – Published: 2026-10-21 00:37 – Updated: 2026-10-21 15:49

Title

Vyper 0.3.8 through 0.5.0b1 Memory Misread via Ternary Nested Array Selection

Summary

Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that reads nested arrays with narrower inner bounds using the wider result type's memory layout. When a ternary selects the narrower array, inner arrays after the first are read at wrong offsets, causing contracts to silently store corrupted values or revert.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-21 14:59 UTC

CWE

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6775 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/vyperlang/vyper/security/advis…	vendor-advisory
https://github.com/vyperlang/vyper/commit/1fb7dfe2	patch
https://www.vulncheck.com/advisories/vyper-0.3.8-…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
vyperlang	vyper	Affected: 0.3.8 , ≤ 0.5.0b1 (python) cpe:2.3:a:vyperlang:vyper::::::::

Date Public

2026-10-05 00:00

Credits

harkal

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-114115",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-21T14:59:59.643585Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-21T15:49:19.495Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/vyper",
          "product": "vyper",
          "vendor": "vyperlang",
          "versions": [
            {
              "lessThanOrEqual": "0.5.0b1",
              "status": "affected",
              "version": "0.3.8",
              "versionType": "python"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "0.5.0b1",
                  "versionStartIncluding": "0.3.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "analyst",
          "value": "harkal"
        }
      ],
      "datePublic": "2026-10-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that reads nested arrays with narrower inner bounds using the wider result type\u0027s memory layout. When a ternary selects the narrower array, inner arrays after the first are read at wrong offsets, causing contracts to silently store corrupted values or revert."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-843",
              "description": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T00:37:13.251Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-cw3h-xwxq-8cx2)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-cw3h-xwxq-8cx2"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/vyperlang/vyper/commit/1fb7dfe2"
        },
        {
          "name": "VulnCheck Advisory: Vyper 0.3.8 through 0.5.0b1 Memory Misread via Ternary Nested Array Selection",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/vyper-0.3.8-through-0.5-0b1-memory-misread-via-ternary-nested-array-selection"
        }
      ],
      "title": "Vyper 0.3.8 through 0.5.0b1 Memory Misread via Ternary Nested Array Selection",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-114115",
    "datePublished": "2026-10-21T00:37:13.251Z",
    "dateReserved": "2026-10-20T21:48:58.503Z",
    "dateUpdated": "2026-10-21T15:49:19.495Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114114 (GCVE-0-2026-114114)

Vulnerability from nvd – Published: 2026-10-21 00:37 – Updated: 2026-10-21 00:37

Title

Vyper through 0.5.0b1 Literal Value Substitution via Multi-byte Characters

Summary

Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct later numeric literals. An attacker contributing source with non-ASCII identifiers that NFKC-normalize to ASCII, or an invisible byte-order mark, can silently substitute addresses, integers or other constants in compiled code.

Severity

6 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

CWE

CWE-176 - Improper Handling of Unicode Encoding

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6775 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/vyperlang/vyper/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/vyper-throug…	third-party-advisory

Impacted products

3 products

Vendor	Product	Version
vyperlang	vyper	Affected: 0.1.0b1 , < 0.1.0b12 (python) Unaffected: 0.1.0b12 (python)
vyperlang	vyper	Affected: 0.1.0b14 , < 0.1.0b15 (python) Unaffected: 0.1.0b15 (python)
vyperlang	vyper	Affected: 0.4.1 , ≤ 0.5.0b1 (python)

Date Public

2026-10-06 00:00

Credits

hyeon-Sec

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/vyper",
          "product": "vyper",
          "vendor": "vyperlang",
          "versions": [
            {
              "lessThan": "0.1.0b12",
              "status": "affected",
              "version": "0.1.0b1",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "0.1.0b12",
              "versionType": "python"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/vyper",
          "product": "vyper",
          "vendor": "vyperlang",
          "versions": [
            {
              "lessThan": "0.1.0b15",
              "status": "affected",
              "version": "0.1.0b14",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "0.1.0b15",
              "versionType": "python"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/vyper",
          "product": "vyper",
          "vendor": "vyperlang",
          "versions": [
            {
              "lessThanOrEqual": "0.5.0b1",
              "status": "affected",
              "version": "0.4.1",
              "versionType": "python"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.1.0b12",
                  "versionStartIncluding": "0.1.0b1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.1.0b15",
                  "versionStartIncluding": "0.1.0b14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "0.5.0b1",
                  "versionStartIncluding": "0.4.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "hyeon-Sec"
        }
      ],
      "datePublic": "2026-10-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python\u0027s UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct later numeric literals. An attacker contributing source with non-ASCII identifiers that NFKC-normalize to ASCII, or an invisible byte-order mark, can silently substitute addresses, integers or other constants in compiled code."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-176",
              "description": "Improper Handling of Unicode Encoding",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T00:37:12.518Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-r3c7-7xwm-6vfw)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-r3c7-7xwm-6vfw"
        },
        {
          "name": "VulnCheck Advisory: Vyper through 0.5.0b1 Literal Value Substitution via Multi-byte Characters",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/vyper-through-0.5-0b1-literal-value-substitution-via-multi-byte-characters"
        }
      ],
      "title": "Vyper through 0.5.0b1 Literal Value Substitution via Multi-byte Characters",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-114114",
    "datePublished": "2026-10-21T00:37:12.518Z",
    "dateReserved": "2026-10-20T21:48:58.503Z",
    "dateUpdated": "2026-10-21T00:37:12.518Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-48020 (GCVE-0-2021-48020)

Vulnerability from nvd – Published: 2026-10-21 00:36 – Updated: 2026-10-21 00:36

Title

Vyper before 0.3.0 Memory Corruption via Internal Function Calls in Arrays

Summary

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are performed inside arrays. Contracts placing internal calls in nested array elements, external call arguments, struct literals, or raw_log topics can have memory corrupted, producing incorrect contract behavior.

Severity

8.3 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L

CWE

CWE-787 - Out-of-bounds Write

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6775 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/vyperlang/vyper/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/vyper-before…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
vyperlang	vyper	Affected: 0.1.0b4 , < 0.3.0 (python) Unaffected: 0.3.0 (python) cpe:2.3:a:vyperlang:vyper::::::::

Date Public

2021-04-16 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/vyper",
          "product": "vyper",
          "vendor": "vyperlang",
          "versions": [
            {
              "lessThan": "0.3.0",
              "status": "affected",
              "version": "0.1.0b4",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "0.3.0",
              "versionType": "python"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.3.0",
                  "versionStartIncluding": "0.1.0b4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2021-04-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are performed inside arrays. Contracts placing internal calls in nested array elements, external call arguments, struct literals, or raw_log topics can have memory corrupted, producing incorrect contract behavior."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T00:36:19.625Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-22wc-c9wj-6q2v)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-22wc-c9wj-6q2v"
        },
        {
          "name": "VulnCheck Advisory: Vyper before 0.3.0 Memory Corruption via Internal Function Calls in Arrays",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/vyper-before-0.3.0-memory-corruption-via-internal-function-calls-in-arrays"
        }
      ],
      "title": "Vyper before 0.3.0 Memory Corruption via Internal Function Calls in Arrays",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2021-48020",
    "datePublished": "2026-10-21T00:36:19.625Z",
    "dateReserved": "2026-10-20T21:52:06.584Z",
    "dateUpdated": "2026-10-21T00:36:19.625Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-48019 (GCVE-0-2021-48019)

Vulnerability from nvd – Published: 2026-10-21 00:36 – Updated: 2026-10-21 00:36

Title

Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies

Summary

Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data when a function returns more than 4096 bytes without return data sanitation, and fail strict return-size checks such as SafeERC20.safeTransfer.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

CWE

CWE-805 - Buffer Access with Incorrect Length Value

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6775 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/vyperlang/vyper/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/vyper-before…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
vyperlang	vyper	Affected: 0 , < 0.2.9 (python) Unaffected: 0.2.9 (python) cpe:2.3:a:vyperlang:vyper::::::::

Date Public

2021-04-16 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/vyper",
          "product": "vyper",
          "vendor": "vyperlang",
          "versions": [
            {
              "lessThan": "0.2.9",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "0.2.9",
              "versionType": "python"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.2.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2021-04-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data when a function returns more than 4096 bytes without return data sanitation, and fail strict return-size checks such as SafeERC20.safeTransfer."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-805",
              "description": "Buffer Access with Incorrect Length Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T00:36:18.960Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-375m-5fvv-xq23)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-375m-5fvv-xq23"
        },
        {
          "name": "VulnCheck Advisory: Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/vyper-before-0.2.9-incorrect-returndatasize-in-create-forwarder-to-proxies"
        }
      ],
      "title": "Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2021-48019",
    "datePublished": "2026-10-21T00:36:18.960Z",
    "dateReserved": "2026-10-20T21:51:44.816Z",
    "dateUpdated": "2026-10-21T00:36:18.960Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-48018 (GCVE-0-2021-48018)

Vulnerability from nvd – Published: 2026-10-21 00:36 – Updated: 2026-10-23 14:57

Title

Vyper 0.2.13 before 0.2.15 Storage Corruption via @nonreentrant Decorator

Summary

Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variables. When a function using @nonreentrant is called, setting the lock overwrites the overlapping storage variable, corrupting contract state and breaking the contract's intended logic.

Severity

8.3 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-23 14:57 UTC

CWE

CWE-787 - Out-of-bounds Write

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6775 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/vyperlang/vyper/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/vyper-0.2.13…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
vyperlang	vyper	Affected: 0.2.13 , < 0.2.15 (python) Unaffected: 0.2.15 (python) cpe:2.3:a:vyperlang:vyper::::::::

Date Public

2021-07-27 00:00

Credits

pandadefi charles-cooper iamdefinitelyahuman

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-48018",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-23T14:57:03.783104Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-23T14:57:15.214Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/vyper",
          "product": "vyper",
          "vendor": "vyperlang",
          "versions": [
            {
              "lessThan": "0.2.15",
              "status": "affected",
              "version": "0.2.13",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "0.2.15",
              "versionType": "python"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.2.15",
                  "versionStartIncluding": "0.2.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "analyst",
          "value": "pandadefi"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "charles-cooper"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "iamdefinitelyahuman"
        }
      ],
      "datePublic": "2021-07-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variables. When a function using @nonreentrant is called, setting the lock overwrites the overlapping storage variable, corrupting contract state and breaking the contract\u0027s intended logic."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T00:36:18.265Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-7f92-rr6w-cq64)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-7f92-rr6w-cq64"
        },
        {
          "name": "VulnCheck Advisory: Vyper 0.2.13 before 0.2.15 Storage Corruption via @nonreentrant Decorator",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/vyper-0.2.13-before-0.2.15-storage-corruption-via-nonreentrant-decorator"
        }
      ],
      "title": "Vyper 0.2.13 before 0.2.15 Storage Corruption via @nonreentrant Decorator",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2021-48018",
    "datePublished": "2026-10-21T00:36:18.265Z",
    "dateReserved": "2026-10-20T21:51:20.819Z",
    "dateUpdated": "2026-10-23T14:57:15.214Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2020-37289 (GCVE-0-2020-37289)

Vulnerability from nvd – Published: 2026-10-21 00:36 – Updated: 2026-10-21 00:36

Title

Vyper before 0.3.1 Improper Input Validation of uint8 Interface Return Values

Summary

Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decimals(), to be stored in uint256 variables without bounds checking. Malicious contracts can return values greater than 255 to manipulate or bypass contract logic that relies on these values.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-20 - Improper Input Validation

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6775 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/vyperlang/vyper/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/vyper-before…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
vyperlang	vyper	Affected: 0 , < 0.3.1 (python) Unaffected: 0.3.1 (python) cpe:2.3:a:vyperlang:vyper::::::::

Date Public

2020-03-09 00:00

Credits

montyly

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/vyper",
          "product": "vyper",
          "vendor": "vyperlang",
          "versions": [
            {
              "lessThan": "0.3.1",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "0.3.1",
              "versionType": "python"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.3.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "analyst",
          "value": "montyly"
        }
      ],
      "datePublic": "2020-03-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decimals(), to be stored in uint256 variables without bounds checking. Malicious contracts can return values greater than 255 to manipulate or bypass contract logic that relies on these values."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T00:36:17.573Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-mr6r-mvw4-736g)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-mr6r-mvw4-736g"
        },
        {
          "name": "VulnCheck Advisory: Vyper before 0.3.1 Improper Input Validation of uint8 Interface Return Values",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/vyper-before-0.3.1-improper-input-validation-of-uint8-interface-return-values"
        }
      ],
      "title": "Vyper before 0.3.1 Improper Input Validation of uint8 Interface Return Values",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2020-37289",
    "datePublished": "2026-10-21T00:36:17.573Z",
    "dateReserved": "2026-10-20T21:53:41.760Z",
    "dateUpdated": "2026-10-21T00:36:17.573Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2020-37288 (GCVE-0-2020-37288)

Vulnerability from nvd – Published: 2026-10-21 00:36 – Updated: 2026-10-21 15:51

Title

Vyper 0.1.0b10 before 0.2.3 Invalid Jump Destination via Return in Nested Loops

Summary

Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination (stack underflow). Affected contracts revert such calls unnecessarily, which in limited circumstances could enable denial of service against public contracts.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-21 14:24 UTC

CWE

CWE-670 - Always-Incorrect Control Flow Implementation

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6775 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/vyperlang/vyper/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/vyper-0.1-0b…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
vyperlang	vyper	Affected: 0.1.0b10 , < 0.2.3 (python) Unaffected: 0.2.3 (python) cpe:2.3:a:vyperlang:vyper::::::::

Date Public

2020-07-16 00:00

Credits

iamdefinitelyahuman

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-37288",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-21T14:24:52.054926Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-21T15:51:17.564Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/vyper",
          "product": "vyper",
          "vendor": "vyperlang",
          "versions": [
            {
              "lessThan": "0.2.3",
              "status": "affected",
              "version": "0.1.0b10",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "0.2.3",
              "versionType": "python"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.2.3",
                  "versionStartIncluding": "0.1.0b10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "analyst",
          "value": "iamdefinitelyahuman"
        }
      ],
      "datePublic": "2020-07-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination (stack underflow). Affected contracts revert such calls unnecessarily, which in limited circumstances could enable denial of service against public contracts."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-670",
              "description": "Always-Incorrect Control Flow Implementation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T00:36:16.926Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-vg88-3v92-rjx2)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-vg88-3v92-rjx2"
        },
        {
          "name": "VulnCheck Advisory: Vyper 0.1.0b10 before 0.2.3 Invalid Jump Destination via Return in Nested Loops",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/vyper-0.1-0b10-before-0.2.3-invalid-jump-destination-via-return-in-nested-loops"
        }
      ],
      "title": "Vyper 0.1.0b10 before 0.2.3 Invalid Jump Destination via Return in Nested Loops",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2020-37288",
    "datePublished": "2026-10-21T00:36:16.926Z",
    "dateReserved": "2026-10-20T21:53:15.776Z",
    "dateUpdated": "2026-10-21T15:51:17.564Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2020-37287 (GCVE-0-2020-37287)

Vulnerability from nvd – Published: 2026-10-21 00:36 – Updated: 2026-10-21 00:36

Title

Vyper before 0.2.6 Call Stack Corruption via Complex Type Function Arguments

Summary

Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passed as arguments. Contracts passing multi-dimensional arrays or structs to internal or external functions receive corrupted values because the compiler assumed each subtype size is 32.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE

CWE-131 - Incorrect Calculation of Buffer Size

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6775 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/vyperlang/vyper/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/vyper-before…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
vyperlang	vyper	Affected: 0 , < 0.2.6 (python) Unaffected: 0.2.6 (python) cpe:2.3:a:vyperlang:vyper::::::::

Date Public

2020-10-10 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/vyper",
          "product": "vyper",
          "vendor": "vyperlang",
          "versions": [
            {
              "lessThan": "0.2.6",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "0.2.6",
              "versionType": "python"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.2.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2020-10-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passed as arguments. Contracts passing multi-dimensional arrays or structs to internal or external functions receive corrupted values because the compiler assumed each subtype size is 32."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-131",
              "description": "Incorrect Calculation of Buffer Size",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T00:36:16.257Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-4v7v-gqf9-ww2g)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-4v7v-gqf9-ww2g"
        },
        {
          "name": "VulnCheck Advisory: Vyper before 0.2.6 Call Stack Corruption via Complex Type Function Arguments",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/vyper-before-0.2.6-call-stack-corruption-via-complex-type-function-arguments"
        }
      ],
      "title": "Vyper before 0.2.6 Call Stack Corruption via Complex Type Function Arguments",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2020-37287",
    "datePublished": "2026-10-21T00:36:16.257Z",
    "dateReserved": "2026-10-20T21:52:54.416Z",
    "dateUpdated": "2026-10-21T00:36:16.257Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2020-37286 (GCVE-0-2020-37286)

Vulnerability from nvd – Published: 2026-10-21 00:36 – Updated: 2026-10-21 00:36

Title

Vyper 0.1.0b4 before 0.3.0 Memory Corruption via Nested Internal Function Calls

Summary

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested calls. Contracts using such calls as tuple elements, call arguments, or builtin arguments like concat or ecrecover can return corrupted values or pass wrong arguments to external calls.

Severity

8.3 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L

CWE

CWE-787 - Out-of-bounds Write

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6775 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/vyperlang/vyper/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/vyper-0.1-0b…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
vyperlang	vyper	Affected: 0.1.0b4 , < 0.3.0 (python) Unaffected: 0.3.0 (python) cpe:2.3:a:vyperlang:vyper::::::::

Date Public

2020-10-10 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/vyper",
          "product": "vyper",
          "vendor": "vyperlang",
          "versions": [
            {
              "lessThan": "0.3.0",
              "status": "affected",
              "version": "0.1.0b4",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "0.3.0",
              "versionType": "python"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.3.0",
                  "versionStartIncluding": "0.1.0b4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2020-10-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested calls. Contracts using such calls as tuple elements, call arguments, or builtin arguments like concat or ecrecover can return corrupted values or pass wrong arguments to external calls."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T00:36:15.568Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-2r3x-4mrv-mcxf)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-2r3x-4mrv-mcxf"
        },
        {
          "name": "VulnCheck Advisory: Vyper 0.1.0b4 before 0.3.0 Memory Corruption via Nested Internal Function Calls",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/vyper-0.1-0b4-before-0.3.0-memory-corruption-via-nested-internal-function-calls"
        }
      ],
      "title": "Vyper 0.1.0b4 before 0.3.0 Memory Corruption via Nested Internal Function Calls",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2020-37286",
    "datePublished": "2026-10-21T00:36:15.568Z",
    "dateReserved": "2026-10-20T21:52:33.085Z",
    "dateUpdated": "2026-10-21T00:36:15.568Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-47774 (GCVE-0-2025-47774)

Vulnerability from nvd – Published: 2025-05-15 17:38 – Updated: 2025-05-15 18:33

Title

Vyper's `slice()` may elide side-effects when output length is 0

Summary

Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, the `slice()` builtin can elide side effects when the output length is 0, and the source bytestring is a builtin (`msg.data` or `<address>.code`). The reason is that for these source locations, the check that `length >= 1` is skipped. The result is that a 0-length bytestring constructed with slice can be passed to `make_byte_array_copier`, which elides evaluation of its source argument when the max length is 0. The impact is that side effects in the `start` argument may be elided when the `length` argument is 0, e.g. `slice(msg.data, self.do_side_effect(), 0)`. The fix in pull request 4645 disallows any invocation of `slice()` with length 0, including for the ad hoc locations discussed in this advisory. The fix is expected to be part of version 0.4.2.

Severity

2.9 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-05-15 18:33 UTC

CWE

CWE-691 - Insufficient Control Flow Management

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7760 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/vyperlang/vyper/security/advis…	x_refsource_CONFIRM
https://github.com/vyperlang/vyper/pull/4645	x_refsource_MISC
https://github.com/vyperlang/vyper/blob/68b68c4b3…	x_refsource_MISC
https://github.com/vyperlang/vyper/blob/68b68c4b3…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
vyperlang	vyper	Affected: <= 0.4.2rc1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-47774",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-15T18:33:24.817738Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-15T18:33:29.976Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vyper",
          "vendor": "vyperlang",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 0.4.2rc1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, the `slice()` builtin can elide side effects when the output length is 0, and the source bytestring is a builtin (`msg.data` or `\u003caddress\u003e.code`). The reason is that for these source locations, the check that `length \u003e= 1` is skipped. The result is that a 0-length bytestring constructed with slice can be passed to `make_byte_array_copier`, which elides evaluation of its source argument when the max length is 0. The impact is that side effects in the `start` argument may be elided when the `length` argument is 0, e.g. `slice(msg.data, self.do_side_effect(), 0)`. The fix in pull request 4645 disallows any invocation of `slice()` with length 0, including for the ad hoc locations discussed in this advisory. The fix is expected to be part of version 0.4.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.9,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-691",
              "description": "CWE-691: Insufficient Control Flow Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-15T17:38:58.487Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vyperlang/vyper/security/advisories/GHSA-3vcg-j39x-cwfm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-3vcg-j39x-cwfm"
        },
        {
          "name": "https://github.com/vyperlang/vyper/pull/4645",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vyperlang/vyper/pull/4645"
        },
        {
          "name": "https://github.com/vyperlang/vyper/blob/68b68c4b30c5ef2f312b4674676170b8a6eaa316/vyper/builtins/functions.py#L315-L319",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vyperlang/vyper/blob/68b68c4b30c5ef2f312b4674676170b8a6eaa316/vyper/builtins/functions.py#L315-L319"
        },
        {
          "name": "https://github.com/vyperlang/vyper/blob/68b68c4b30c5ef2f312b4674676170b8a6eaa316/vyper/codegen/core.py#L189-L191",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vyperlang/vyper/blob/68b68c4b30c5ef2f312b4674676170b8a6eaa316/vyper/codegen/core.py#L189-L191"
        }
      ],
      "source": {
        "advisory": "GHSA-3vcg-j39x-cwfm",
        "discovery": "UNKNOWN"
      },
      "title": "Vyper\u0027s `slice()` may elide side-effects when output length is 0"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-47774",
    "datePublished": "2025-05-15T17:38:58.487Z",
    "dateReserved": "2025-05-09T19:49:35.619Z",
    "dateUpdated": "2025-05-15T18:33:29.976Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-47285 (GCVE-0-2025-47285)

Vulnerability from nvd – Published: 2025-05-15 17:24 – Updated: 2025-05-15 18:37

Title

Vyper's `concat()` builtin may elide side-effects for zero-length arguments

Summary

Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, `concat()` may skip evaluation of side effects when the length of an argument is zero. This is due to a fastpath in the implementation which skips evaluation of argument expressions when their length is zero. In practice, it would be very unusual in user code to construct zero-length bytestrings using an expression with side-effects, since zero-length bytestrings are typically constructed with the empty literal `b""`; the only way to construct an empty bytestring which has side effects would be with the ternary operator introduced in v0.3.8, e.g. `b"" if self.do_some_side_effect() else b""`. The fix is available in pull request 4644 and expected to be part of the 0.4.2 release. As a workaround, don't have side effects in expressions which construct zero-length bytestrings.

Severity

2.9 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-05-15 18:37 UTC

CWE

CWE-691 - Insufficient Control Flow Management

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7760 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/vyperlang/vyper/security/advis…	x_refsource_CONFIRM
https://github.com/vyperlang/vyper/pull/4644	x_refsource_MISC
https://github.com/vyperlang/vyper/blob/68b68c4b3…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
vyperlang	vyper	Affected: <= 0.4.2rc1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-47285",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-15T18:37:27.011947Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-15T18:37:33.747Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vyper",
          "vendor": "vyperlang",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 0.4.2rc1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, `concat()` may skip evaluation of side effects when the length of an argument is zero. This is due to a fastpath in the implementation which skips evaluation of argument expressions when their length is zero. In practice, it would be very unusual in user code to construct zero-length bytestrings using an expression with side-effects, since zero-length bytestrings are typically constructed with the empty literal `b\"\"`; the only way to construct an empty bytestring which has side effects would be with the ternary operator introduced in v0.3.8, e.g. `b\"\" if self.do_some_side_effect() else b\"\"`. The fix is available in pull request 4644 and expected to be part of the 0.4.2 release. As a workaround, don\u0027t have side effects in expressions which construct zero-length bytestrings."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.9,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-691",
              "description": "CWE-691: Insufficient Control Flow Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-15T17:24:03.442Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vyperlang/vyper/security/advisories/GHSA-qhr6-mgqr-mchm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-qhr6-mgqr-mchm"
        },
        {
          "name": "https://github.com/vyperlang/vyper/pull/4644",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vyperlang/vyper/pull/4644"
        },
        {
          "name": "https://github.com/vyperlang/vyper/blob/68b68c4b30c5ef2f312b4674676170b8a6eaa316/vyper/builtins/functions.py#L560-L562",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vyperlang/vyper/blob/68b68c4b30c5ef2f312b4674676170b8a6eaa316/vyper/builtins/functions.py#L560-L562"
        }
      ],
      "source": {
        "advisory": "GHSA-qhr6-mgqr-mchm",
        "discovery": "UNKNOWN"
      },
      "title": "Vyper\u0027s `concat()` builtin may elide side-effects for zero-length arguments"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-47285",
    "datePublished": "2025-05-15T17:24:03.442Z",
    "dateReserved": "2025-05-05T16:53:10.374Z",
    "dateUpdated": "2025-05-15T18:37:33.747Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-114663 (GCVE-0-2026-114663)

Vulnerability from cvelistv5 – Published: 2026-10-22 01:43 – Updated: 2026-10-23 15:06

Title

Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments

Summary

Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name, attacker-influenced input can replace the intended value, including out-of-range values for narrow types such as uint8, corrupting validation or accounting logic.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.4 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-23 14:54 UTC

CWE

CWE-706 - Use of Incorrectly-Resolved Name or Reference

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6775 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/vyperlang/vyper/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/vyper-0.4-0b…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
vyperlang	vyper	Affected: 0.4.0b1 , ≤ 0.5.0b1 (python) cpe:2.3:a:vyperlang:vyper::::::::

Date Public

2026-10-07 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-114663",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-23T14:54:17.794694Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-23T15:06:28.237Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/vyper",
          "product": "vyper",
          "vendor": "vyperlang",
          "versions": [
            {
              "lessThanOrEqual": "0.5.0b1",
              "status": "affected",
              "version": "0.4.0b1",
              "versionType": "python"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "0.5.0b1",
                  "versionStartIncluding": "0.4.0b1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-10-07T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function\u0027s scope rather than at declaration. When a contract\u0027s parameter, local, or loop variable shares such a name, attacker-influenced input can replace the intended value, including out-of-range values for narrow types such as uint8, corrupting validation or accounting logic."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-706",
              "description": "Use of Incorrectly-Resolved Name or Reference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T01:43:46.942Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-2489-32vh-8rrc)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-2489-32vh-8rrc"
        },
        {
          "name": "VulnCheck Advisory: Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/vyper-0.4-0b1-through-0.5-0b1-name-shadowing-of-imported-constants-and-default-arguments"
        }
      ],
      "title": "Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-114663",
    "datePublished": "2026-10-22T01:43:46.942Z",
    "dateReserved": "2026-10-21T21:59:05.257Z",
    "dateUpdated": "2026-10-23T15:06:28.237Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114118 (GCVE-0-2026-114118)

Vulnerability from cvelistv5 – Published: 2026-10-21 00:37 – Updated: 2026-10-21 00:37

Title

Vyper 0.3.4 through 0.5.0b1 create_from_blueprint Offset Validation Bypass via Unsigned Wraparound

Summary

Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by uint256 subtraction without first checking that code_offset is below the blueprint's code size, so a huge offset wraps to a small positive value. An attacker controlling code_offset can make a factory deploy contracts with no runtime code, potentially trapping ETH and tokens.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

CWE

CWE-681 - Incorrect Conversion between Numeric Types

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6775 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/vyperlang/vyper/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/vyper-0.3.4-…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
vyperlang	vyper	Affected: 0.3.4 , ≤ 0.5.0b1 (python) cpe:2.3:a:vyperlang:vyper::::::::

Date Public

2026-10-06 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/vyper",
          "product": "vyper",
          "vendor": "vyperlang",
          "versions": [
            {
              "lessThanOrEqual": "0.5.0b1",
              "status": "affected",
              "version": "0.3.4",
              "versionType": "python"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "0.5.0b1",
                  "versionStartIncluding": "0.3.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-10-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by uint256 subtraction without first checking that code_offset is below the blueprint\u0027s code size, so a huge offset wraps to a small positive value. An attacker controlling code_offset can make a factory deploy contracts with no runtime code, potentially trapping ETH and tokens."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-681",
              "description": "Incorrect Conversion between Numeric Types",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T00:37:15.454Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-fxg7-4wqg-c8gh)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-fxg7-4wqg-c8gh"
        },
        {
          "name": "VulnCheck Advisory: Vyper 0.3.4 through 0.5.0b1 create_from_blueprint Offset Validation Bypass via Unsigned Wraparound",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/vyper-0.3.4-through-0.5-0b1-create-from-blueprint-offset-validation-bypass-via-unsigned-wraparound"
        }
      ],
      "title": "Vyper 0.3.4 through 0.5.0b1 create_from_blueprint Offset Validation Bypass via Unsigned Wraparound",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-114118",
    "datePublished": "2026-10-21T00:37:15.454Z",
    "dateReserved": "2026-10-20T21:48:58.503Z",
    "dateUpdated": "2026-10-21T00:37:15.454Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114117 (GCVE-0-2026-114117)

Vulnerability from cvelistv5 – Published: 2026-10-21 00:37 – Updated: 2026-10-21 20:12

Title

Vyper 0.3.8 through 0.5.0b1 Optimizer Miscompilation of msg.value | K in Ternary Branches

Summary

Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas (the default) or -O codesize. Affected contracts use the wrong value in storage writes, arithmetic, indexes, return values, or events without warning or revert, which can record deposits incorrectly and lock funds.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-21 20:11 UTC

CWE

CWE-682 - Incorrect Calculation

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6775 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/vyperlang/vyper/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/vyper-0.3.8-…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
vyperlang	vyper	Affected: 0.3.8 , ≤ 0.5.0b1 (python) cpe:2.3:a:vyperlang:vyper::::::::

Date Public

2026-10-02 00:00

Credits

DELENE-TCHIO-ROMUALD

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-114117",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-21T20:11:58.758962Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-21T20:12:04.759Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-6j9c-gvcw-74fj"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/vyper",
          "product": "vyper",
          "vendor": "vyperlang",
          "versions": [
            {
              "lessThanOrEqual": "0.5.0b1",
              "status": "affected",
              "version": "0.3.8",
              "versionType": "python"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "0.5.0b1",
                  "versionStartIncluding": "0.3.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "DELENE-TCHIO-ROMUALD"
        }
      ],
      "datePublic": "2026-10-02T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas (the default) or -O codesize. Affected contracts use the wrong value in storage writes, arithmetic, indexes, return values, or events without warning or revert, which can record deposits incorrectly and lock funds."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-682",
              "description": "Incorrect Calculation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T00:37:14.741Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-6j9c-gvcw-74fj)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-6j9c-gvcw-74fj"
        },
        {
          "name": "VulnCheck Advisory: Vyper 0.3.8 through 0.5.0b1 Optimizer Miscompilation of msg.value | K in Ternary Branches",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/vyper-0.3.8-through-0.5-0b1-optimizer-miscompilation-of-msg-value-k-in-ternary-branches"
        }
      ],
      "title": "Vyper 0.3.8 through 0.5.0b1 Optimizer Miscompilation of msg.value | K in Ternary Branches",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-114117",
    "datePublished": "2026-10-21T00:37:14.741Z",
    "dateReserved": "2026-10-20T21:48:58.503Z",
    "dateUpdated": "2026-10-21T20:12:04.759Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114116 (GCVE-0-2026-114116)

Vulnerability from cvelistv5 – Published: 2026-10-21 00:37 – Updated: 2026-10-21 00:37

Title

Vyper through 0.5.0b1 Literal Value Manipulation via Line Separators

Summary

Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker contributing source code can hide these characters in comments, strings or indentation to silently change address, integer or decimal constants.

Severity

6 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

CWE

CWE-436 - Interpretation Conflict

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6775 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/vyperlang/vyper/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/vyper-throug…	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
vyperlang	vyper	Affected: 0.1.0b1 , < 0.1.0b17 (python) Unaffected: 0.1.0b17 (python)
vyperlang	vyper	Affected: 0.4.1 , ≤ 0.5.0b1 (python)

Date Public

2026-10-06 00:00

Credits

DELENE-TCHIO-ROMUALD

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/vyper",
          "product": "vyper",
          "vendor": "vyperlang",
          "versions": [
            {
              "lessThan": "0.1.0b17",
              "status": "affected",
              "version": "0.1.0b1",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "0.1.0b17",
              "versionType": "python"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/vyper",
          "product": "vyper",
          "vendor": "vyperlang",
          "versions": [
            {
              "lessThanOrEqual": "0.5.0b1",
              "status": "affected",
              "version": "0.4.1",
              "versionType": "python"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.1.0b17",
                  "versionStartIncluding": "0.1.0b1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "0.5.0b1",
                  "versionStartIncluding": "0.4.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "DELENE-TCHIO-ROMUALD"
        }
      ],
      "datePublic": "2026-10-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker contributing source code can hide these characters in comments, strings or indentation to silently change address, integer or decimal constants."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T00:37:13.988Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-wvx7-39qj-2g9v)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-wvx7-39qj-2g9v"
        },
        {
          "name": "VulnCheck Advisory: Vyper through 0.5.0b1 Literal Value Manipulation via Line Separators",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/vyper-through-0.5-0b1-literal-value-manipulation-via-line-separators"
        }
      ],
      "title": "Vyper through 0.5.0b1 Literal Value Manipulation via Line Separators",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-114116",
    "datePublished": "2026-10-21T00:37:13.988Z",
    "dateReserved": "2026-10-20T21:48:58.503Z",
    "dateUpdated": "2026-10-21T00:37:13.988Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114115 (GCVE-0-2026-114115)

Vulnerability from cvelistv5 – Published: 2026-10-21 00:37 – Updated: 2026-10-21 15:49

Title

Vyper 0.3.8 through 0.5.0b1 Memory Misread via Ternary Nested Array Selection

Summary

Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that reads nested arrays with narrower inner bounds using the wider result type's memory layout. When a ternary selects the narrower array, inner arrays after the first are read at wrong offsets, causing contracts to silently store corrupted values or revert.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-21 14:59 UTC

CWE

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6775 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/vyperlang/vyper/security/advis…	vendor-advisory
https://github.com/vyperlang/vyper/commit/1fb7dfe2	patch
https://www.vulncheck.com/advisories/vyper-0.3.8-…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
vyperlang	vyper	Affected: 0.3.8 , ≤ 0.5.0b1 (python) cpe:2.3:a:vyperlang:vyper::::::::

Date Public

2026-10-05 00:00

Credits

harkal

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-114115",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-21T14:59:59.643585Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-21T15:49:19.495Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/vyper",
          "product": "vyper",
          "vendor": "vyperlang",
          "versions": [
            {
              "lessThanOrEqual": "0.5.0b1",
              "status": "affected",
              "version": "0.3.8",
              "versionType": "python"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "0.5.0b1",
                  "versionStartIncluding": "0.3.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "analyst",
          "value": "harkal"
        }
      ],
      "datePublic": "2026-10-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that reads nested arrays with narrower inner bounds using the wider result type\u0027s memory layout. When a ternary selects the narrower array, inner arrays after the first are read at wrong offsets, causing contracts to silently store corrupted values or revert."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-843",
              "description": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T00:37:13.251Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-cw3h-xwxq-8cx2)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-cw3h-xwxq-8cx2"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/vyperlang/vyper/commit/1fb7dfe2"
        },
        {
          "name": "VulnCheck Advisory: Vyper 0.3.8 through 0.5.0b1 Memory Misread via Ternary Nested Array Selection",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/vyper-0.3.8-through-0.5-0b1-memory-misread-via-ternary-nested-array-selection"
        }
      ],
      "title": "Vyper 0.3.8 through 0.5.0b1 Memory Misread via Ternary Nested Array Selection",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-114115",
    "datePublished": "2026-10-21T00:37:13.251Z",
    "dateReserved": "2026-10-20T21:48:58.503Z",
    "dateUpdated": "2026-10-21T15:49:19.495Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114114 (GCVE-0-2026-114114)

Vulnerability from cvelistv5 – Published: 2026-10-21 00:37 – Updated: 2026-10-21 00:37

Title

Vyper through 0.5.0b1 Literal Value Substitution via Multi-byte Characters

Summary

Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct later numeric literals. An attacker contributing source with non-ASCII identifiers that NFKC-normalize to ASCII, or an invisible byte-order mark, can silently substitute addresses, integers or other constants in compiled code.

Severity

6 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

CWE

CWE-176 - Improper Handling of Unicode Encoding

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6775 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/vyperlang/vyper/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/vyper-throug…	third-party-advisory

Impacted products

3 products

Vendor	Product	Version
vyperlang	vyper	Affected: 0.1.0b1 , < 0.1.0b12 (python) Unaffected: 0.1.0b12 (python)
vyperlang	vyper	Affected: 0.1.0b14 , < 0.1.0b15 (python) Unaffected: 0.1.0b15 (python)
vyperlang	vyper	Affected: 0.4.1 , ≤ 0.5.0b1 (python)

Date Public

2026-10-06 00:00

Credits

hyeon-Sec

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/vyper",
          "product": "vyper",
          "vendor": "vyperlang",
          "versions": [
            {
              "lessThan": "0.1.0b12",
              "status": "affected",
              "version": "0.1.0b1",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "0.1.0b12",
              "versionType": "python"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/vyper",
          "product": "vyper",
          "vendor": "vyperlang",
          "versions": [
            {
              "lessThan": "0.1.0b15",
              "status": "affected",
              "version": "0.1.0b14",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "0.1.0b15",
              "versionType": "python"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/vyper",
          "product": "vyper",
          "vendor": "vyperlang",
          "versions": [
            {
              "lessThanOrEqual": "0.5.0b1",
              "status": "affected",
              "version": "0.4.1",
              "versionType": "python"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.1.0b12",
                  "versionStartIncluding": "0.1.0b1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.1.0b15",
                  "versionStartIncluding": "0.1.0b14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "0.5.0b1",
                  "versionStartIncluding": "0.4.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "hyeon-Sec"
        }
      ],
      "datePublic": "2026-10-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python\u0027s UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct later numeric literals. An attacker contributing source with non-ASCII identifiers that NFKC-normalize to ASCII, or an invisible byte-order mark, can silently substitute addresses, integers or other constants in compiled code."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-176",
              "description": "Improper Handling of Unicode Encoding",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T00:37:12.518Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-r3c7-7xwm-6vfw)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-r3c7-7xwm-6vfw"
        },
        {
          "name": "VulnCheck Advisory: Vyper through 0.5.0b1 Literal Value Substitution via Multi-byte Characters",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/vyper-through-0.5-0b1-literal-value-substitution-via-multi-byte-characters"
        }
      ],
      "title": "Vyper through 0.5.0b1 Literal Value Substitution via Multi-byte Characters",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-114114",
    "datePublished": "2026-10-21T00:37:12.518Z",
    "dateReserved": "2026-10-20T21:48:58.503Z",
    "dateUpdated": "2026-10-21T00:37:12.518Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-48020 (GCVE-0-2021-48020)

Vulnerability from cvelistv5 – Published: 2026-10-21 00:36 – Updated: 2026-10-21 00:36

Title

Vyper before 0.3.0 Memory Corruption via Internal Function Calls in Arrays

Summary

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are performed inside arrays. Contracts placing internal calls in nested array elements, external call arguments, struct literals, or raw_log topics can have memory corrupted, producing incorrect contract behavior.

Severity

8.3 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L

CWE

CWE-787 - Out-of-bounds Write

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6775 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/vyperlang/vyper/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/vyper-before…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
vyperlang	vyper	Affected: 0.1.0b4 , < 0.3.0 (python) Unaffected: 0.3.0 (python) cpe:2.3:a:vyperlang:vyper::::::::

Date Public

2021-04-16 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/vyper",
          "product": "vyper",
          "vendor": "vyperlang",
          "versions": [
            {
              "lessThan": "0.3.0",
              "status": "affected",
              "version": "0.1.0b4",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "0.3.0",
              "versionType": "python"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.3.0",
                  "versionStartIncluding": "0.1.0b4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2021-04-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are performed inside arrays. Contracts placing internal calls in nested array elements, external call arguments, struct literals, or raw_log topics can have memory corrupted, producing incorrect contract behavior."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T00:36:19.625Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-22wc-c9wj-6q2v)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-22wc-c9wj-6q2v"
        },
        {
          "name": "VulnCheck Advisory: Vyper before 0.3.0 Memory Corruption via Internal Function Calls in Arrays",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/vyper-before-0.3.0-memory-corruption-via-internal-function-calls-in-arrays"
        }
      ],
      "title": "Vyper before 0.3.0 Memory Corruption via Internal Function Calls in Arrays",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2021-48020",
    "datePublished": "2026-10-21T00:36:19.625Z",
    "dateReserved": "2026-10-20T21:52:06.584Z",
    "dateUpdated": "2026-10-21T00:36:19.625Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-48019 (GCVE-0-2021-48019)

Vulnerability from cvelistv5 – Published: 2026-10-21 00:36 – Updated: 2026-10-21 00:36

Title

Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies

Summary

Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data when a function returns more than 4096 bytes without return data sanitation, and fail strict return-size checks such as SafeERC20.safeTransfer.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

CWE

CWE-805 - Buffer Access with Incorrect Length Value

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6775 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/vyperlang/vyper/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/vyper-before…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
vyperlang	vyper	Affected: 0 , < 0.2.9 (python) Unaffected: 0.2.9 (python) cpe:2.3:a:vyperlang:vyper::::::::

Date Public

2021-04-16 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/vyper",
          "product": "vyper",
          "vendor": "vyperlang",
          "versions": [
            {
              "lessThan": "0.2.9",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "0.2.9",
              "versionType": "python"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.2.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2021-04-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data when a function returns more than 4096 bytes without return data sanitation, and fail strict return-size checks such as SafeERC20.safeTransfer."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-805",
              "description": "Buffer Access with Incorrect Length Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T00:36:18.960Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-375m-5fvv-xq23)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-375m-5fvv-xq23"
        },
        {
          "name": "VulnCheck Advisory: Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/vyper-before-0.2.9-incorrect-returndatasize-in-create-forwarder-to-proxies"
        }
      ],
      "title": "Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2021-48019",
    "datePublished": "2026-10-21T00:36:18.960Z",
    "dateReserved": "2026-10-20T21:51:44.816Z",
    "dateUpdated": "2026-10-21T00:36:18.960Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-48018 (GCVE-0-2021-48018)

Vulnerability from cvelistv5 – Published: 2026-10-21 00:36 – Updated: 2026-10-23 14:57

Title

Vyper 0.2.13 before 0.2.15 Storage Corruption via @nonreentrant Decorator

Summary

Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variables. When a function using @nonreentrant is called, setting the lock overwrites the overlapping storage variable, corrupting contract state and breaking the contract's intended logic.

Severity

8.3 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-23 14:57 UTC

CWE

CWE-787 - Out-of-bounds Write

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6775 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/vyperlang/vyper/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/vyper-0.2.13…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
vyperlang	vyper	Affected: 0.2.13 , < 0.2.15 (python) Unaffected: 0.2.15 (python) cpe:2.3:a:vyperlang:vyper::::::::

Date Public

2021-07-27 00:00

Credits

pandadefi charles-cooper iamdefinitelyahuman

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-48018",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-23T14:57:03.783104Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-23T14:57:15.214Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/vyper",
          "product": "vyper",
          "vendor": "vyperlang",
          "versions": [
            {
              "lessThan": "0.2.15",
              "status": "affected",
              "version": "0.2.13",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "0.2.15",
              "versionType": "python"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.2.15",
                  "versionStartIncluding": "0.2.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "analyst",
          "value": "pandadefi"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "charles-cooper"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "iamdefinitelyahuman"
        }
      ],
      "datePublic": "2021-07-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variables. When a function using @nonreentrant is called, setting the lock overwrites the overlapping storage variable, corrupting contract state and breaking the contract\u0027s intended logic."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T00:36:18.265Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-7f92-rr6w-cq64)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-7f92-rr6w-cq64"
        },
        {
          "name": "VulnCheck Advisory: Vyper 0.2.13 before 0.2.15 Storage Corruption via @nonreentrant Decorator",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/vyper-0.2.13-before-0.2.15-storage-corruption-via-nonreentrant-decorator"
        }
      ],
      "title": "Vyper 0.2.13 before 0.2.15 Storage Corruption via @nonreentrant Decorator",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2021-48018",
    "datePublished": "2026-10-21T00:36:18.265Z",
    "dateReserved": "2026-10-20T21:51:20.819Z",
    "dateUpdated": "2026-10-23T14:57:15.214Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2020-37289 (GCVE-0-2020-37289)

Vulnerability from cvelistv5 – Published: 2026-10-21 00:36 – Updated: 2026-10-21 00:36

Title

Vyper before 0.3.1 Improper Input Validation of uint8 Interface Return Values

Summary

Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decimals(), to be stored in uint256 variables without bounds checking. Malicious contracts can return values greater than 255 to manipulate or bypass contract logic that relies on these values.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-20 - Improper Input Validation

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6775 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/vyperlang/vyper/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/vyper-before…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
vyperlang	vyper	Affected: 0 , < 0.3.1 (python) Unaffected: 0.3.1 (python) cpe:2.3:a:vyperlang:vyper::::::::

Date Public

2020-03-09 00:00

Credits

montyly

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/vyper",
          "product": "vyper",
          "vendor": "vyperlang",
          "versions": [
            {
              "lessThan": "0.3.1",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "0.3.1",
              "versionType": "python"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.3.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "analyst",
          "value": "montyly"
        }
      ],
      "datePublic": "2020-03-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decimals(), to be stored in uint256 variables without bounds checking. Malicious contracts can return values greater than 255 to manipulate or bypass contract logic that relies on these values."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T00:36:17.573Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-mr6r-mvw4-736g)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-mr6r-mvw4-736g"
        },
        {
          "name": "VulnCheck Advisory: Vyper before 0.3.1 Improper Input Validation of uint8 Interface Return Values",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/vyper-before-0.3.1-improper-input-validation-of-uint8-interface-return-values"
        }
      ],
      "title": "Vyper before 0.3.1 Improper Input Validation of uint8 Interface Return Values",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2020-37289",
    "datePublished": "2026-10-21T00:36:17.573Z",
    "dateReserved": "2026-10-20T21:53:41.760Z",
    "dateUpdated": "2026-10-21T00:36:17.573Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2020-37288 (GCVE-0-2020-37288)

Vulnerability from cvelistv5 – Published: 2026-10-21 00:36 – Updated: 2026-10-21 15:51

Title

Vyper 0.1.0b10 before 0.2.3 Invalid Jump Destination via Return in Nested Loops

Summary

Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination (stack underflow). Affected contracts revert such calls unnecessarily, which in limited circumstances could enable denial of service against public contracts.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-21 14:24 UTC

CWE

CWE-670 - Always-Incorrect Control Flow Implementation

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6775 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/vyperlang/vyper/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/vyper-0.1-0b…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
vyperlang	vyper	Affected: 0.1.0b10 , < 0.2.3 (python) Unaffected: 0.2.3 (python) cpe:2.3:a:vyperlang:vyper::::::::

Date Public

2020-07-16 00:00

Credits

iamdefinitelyahuman

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-37288",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-21T14:24:52.054926Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-21T15:51:17.564Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/vyper",
          "product": "vyper",
          "vendor": "vyperlang",
          "versions": [
            {
              "lessThan": "0.2.3",
              "status": "affected",
              "version": "0.1.0b10",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "0.2.3",
              "versionType": "python"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.2.3",
                  "versionStartIncluding": "0.1.0b10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "analyst",
          "value": "iamdefinitelyahuman"
        }
      ],
      "datePublic": "2020-07-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination (stack underflow). Affected contracts revert such calls unnecessarily, which in limited circumstances could enable denial of service against public contracts."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-670",
              "description": "Always-Incorrect Control Flow Implementation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T00:36:16.926Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-vg88-3v92-rjx2)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-vg88-3v92-rjx2"
        },
        {
          "name": "VulnCheck Advisory: Vyper 0.1.0b10 before 0.2.3 Invalid Jump Destination via Return in Nested Loops",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/vyper-0.1-0b10-before-0.2.3-invalid-jump-destination-via-return-in-nested-loops"
        }
      ],
      "title": "Vyper 0.1.0b10 before 0.2.3 Invalid Jump Destination via Return in Nested Loops",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2020-37288",
    "datePublished": "2026-10-21T00:36:16.926Z",
    "dateReserved": "2026-10-20T21:53:15.776Z",
    "dateUpdated": "2026-10-21T15:51:17.564Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2020-37287 (GCVE-0-2020-37287)

Vulnerability from cvelistv5 – Published: 2026-10-21 00:36 – Updated: 2026-10-21 00:36

Title

Vyper before 0.2.6 Call Stack Corruption via Complex Type Function Arguments

Summary

Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passed as arguments. Contracts passing multi-dimensional arrays or structs to internal or external functions receive corrupted values because the compiler assumed each subtype size is 32.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE

CWE-131 - Incorrect Calculation of Buffer Size

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6775 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/vyperlang/vyper/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/vyper-before…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
vyperlang	vyper	Affected: 0 , < 0.2.6 (python) Unaffected: 0.2.6 (python) cpe:2.3:a:vyperlang:vyper::::::::

Date Public

2020-10-10 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/vyper",
          "product": "vyper",
          "vendor": "vyperlang",
          "versions": [
            {
              "lessThan": "0.2.6",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "0.2.6",
              "versionType": "python"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.2.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2020-10-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passed as arguments. Contracts passing multi-dimensional arrays or structs to internal or external functions receive corrupted values because the compiler assumed each subtype size is 32."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-131",
              "description": "Incorrect Calculation of Buffer Size",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T00:36:16.257Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-4v7v-gqf9-ww2g)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-4v7v-gqf9-ww2g"
        },
        {
          "name": "VulnCheck Advisory: Vyper before 0.2.6 Call Stack Corruption via Complex Type Function Arguments",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/vyper-before-0.2.6-call-stack-corruption-via-complex-type-function-arguments"
        }
      ],
      "title": "Vyper before 0.2.6 Call Stack Corruption via Complex Type Function Arguments",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2020-37287",
    "datePublished": "2026-10-21T00:36:16.257Z",
    "dateReserved": "2026-10-20T21:52:54.416Z",
    "dateUpdated": "2026-10-21T00:36:16.257Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2020-37286 (GCVE-0-2020-37286)

Vulnerability from cvelistv5 – Published: 2026-10-21 00:36 – Updated: 2026-10-21 00:36

Title

Vyper 0.1.0b4 before 0.3.0 Memory Corruption via Nested Internal Function Calls

Summary

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested calls. Contracts using such calls as tuple elements, call arguments, or builtin arguments like concat or ecrecover can return corrupted values or pass wrong arguments to external calls.

Severity

8.3 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L

CWE

CWE-787 - Out-of-bounds Write

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6775 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/vyperlang/vyper/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/vyper-0.1-0b…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
vyperlang	vyper	Affected: 0.1.0b4 , < 0.3.0 (python) Unaffected: 0.3.0 (python) cpe:2.3:a:vyperlang:vyper::::::::

Date Public

2020-10-10 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/vyper",
          "product": "vyper",
          "vendor": "vyperlang",
          "versions": [
            {
              "lessThan": "0.3.0",
              "status": "affected",
              "version": "0.1.0b4",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "0.3.0",
              "versionType": "python"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.3.0",
                  "versionStartIncluding": "0.1.0b4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2020-10-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested calls. Contracts using such calls as tuple elements, call arguments, or builtin arguments like concat or ecrecover can return corrupted values or pass wrong arguments to external calls."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T00:36:15.568Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-2r3x-4mrv-mcxf)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-2r3x-4mrv-mcxf"
        },
        {
          "name": "VulnCheck Advisory: Vyper 0.1.0b4 before 0.3.0 Memory Corruption via Nested Internal Function Calls",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/vyper-0.1-0b4-before-0.3.0-memory-corruption-via-nested-internal-function-calls"
        }
      ],
      "title": "Vyper 0.1.0b4 before 0.3.0 Memory Corruption via Nested Internal Function Calls",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2020-37286",
    "datePublished": "2026-10-21T00:36:15.568Z",
    "dateReserved": "2026-10-20T21:52:33.085Z",
    "dateUpdated": "2026-10-21T00:36:15.568Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-47774 (GCVE-0-2025-47774)

Vulnerability from cvelistv5 – Published: 2025-05-15 17:38 – Updated: 2025-05-15 18:33

Title

Vyper's `slice()` may elide side-effects when output length is 0

Summary

Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, the `slice()` builtin can elide side effects when the output length is 0, and the source bytestring is a builtin (`msg.data` or `<address>.code`). The reason is that for these source locations, the check that `length >= 1` is skipped. The result is that a 0-length bytestring constructed with slice can be passed to `make_byte_array_copier`, which elides evaluation of its source argument when the max length is 0. The impact is that side effects in the `start` argument may be elided when the `length` argument is 0, e.g. `slice(msg.data, self.do_side_effect(), 0)`. The fix in pull request 4645 disallows any invocation of `slice()` with length 0, including for the ad hoc locations discussed in this advisory. The fix is expected to be part of version 0.4.2.

Severity

2.9 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-05-15 18:33 UTC

CWE

CWE-691 - Insufficient Control Flow Management

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7760 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/vyperlang/vyper/security/advis…	x_refsource_CONFIRM
https://github.com/vyperlang/vyper/pull/4645	x_refsource_MISC
https://github.com/vyperlang/vyper/blob/68b68c4b3…	x_refsource_MISC
https://github.com/vyperlang/vyper/blob/68b68c4b3…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
vyperlang	vyper	Affected: <= 0.4.2rc1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-47774",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-15T18:33:24.817738Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-15T18:33:29.976Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vyper",
          "vendor": "vyperlang",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 0.4.2rc1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, the `slice()` builtin can elide side effects when the output length is 0, and the source bytestring is a builtin (`msg.data` or `\u003caddress\u003e.code`). The reason is that for these source locations, the check that `length \u003e= 1` is skipped. The result is that a 0-length bytestring constructed with slice can be passed to `make_byte_array_copier`, which elides evaluation of its source argument when the max length is 0. The impact is that side effects in the `start` argument may be elided when the `length` argument is 0, e.g. `slice(msg.data, self.do_side_effect(), 0)`. The fix in pull request 4645 disallows any invocation of `slice()` with length 0, including for the ad hoc locations discussed in this advisory. The fix is expected to be part of version 0.4.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.9,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-691",
              "description": "CWE-691: Insufficient Control Flow Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-15T17:38:58.487Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vyperlang/vyper/security/advisories/GHSA-3vcg-j39x-cwfm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-3vcg-j39x-cwfm"
        },
        {
          "name": "https://github.com/vyperlang/vyper/pull/4645",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vyperlang/vyper/pull/4645"
        },
        {
          "name": "https://github.com/vyperlang/vyper/blob/68b68c4b30c5ef2f312b4674676170b8a6eaa316/vyper/builtins/functions.py#L315-L319",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vyperlang/vyper/blob/68b68c4b30c5ef2f312b4674676170b8a6eaa316/vyper/builtins/functions.py#L315-L319"
        },
        {
          "name": "https://github.com/vyperlang/vyper/blob/68b68c4b30c5ef2f312b4674676170b8a6eaa316/vyper/codegen/core.py#L189-L191",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vyperlang/vyper/blob/68b68c4b30c5ef2f312b4674676170b8a6eaa316/vyper/codegen/core.py#L189-L191"
        }
      ],
      "source": {
        "advisory": "GHSA-3vcg-j39x-cwfm",
        "discovery": "UNKNOWN"
      },
      "title": "Vyper\u0027s `slice()` may elide side-effects when output length is 0"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-47774",
    "datePublished": "2025-05-15T17:38:58.487Z",
    "dateReserved": "2025-05-09T19:49:35.619Z",
    "dateUpdated": "2025-05-15T18:33:29.976Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-47285 (GCVE-0-2025-47285)

Vulnerability from cvelistv5 – Published: 2025-05-15 17:24 – Updated: 2025-05-15 18:37

Title

Vyper's `concat()` builtin may elide side-effects for zero-length arguments

Summary

Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, `concat()` may skip evaluation of side effects when the length of an argument is zero. This is due to a fastpath in the implementation which skips evaluation of argument expressions when their length is zero. In practice, it would be very unusual in user code to construct zero-length bytestrings using an expression with side-effects, since zero-length bytestrings are typically constructed with the empty literal `b""`; the only way to construct an empty bytestring which has side effects would be with the ternary operator introduced in v0.3.8, e.g. `b"" if self.do_some_side_effect() else b""`. The fix is available in pull request 4644 and expected to be part of the 0.4.2 release. As a workaround, don't have side effects in expressions which construct zero-length bytestrings.

Severity

2.9 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-05-15 18:37 UTC

CWE

CWE-691 - Insufficient Control Flow Management

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7760 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/vyperlang/vyper/security/advis…	x_refsource_CONFIRM
https://github.com/vyperlang/vyper/pull/4644	x_refsource_MISC
https://github.com/vyperlang/vyper/blob/68b68c4b3…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
vyperlang	vyper	Affected: <= 0.4.2rc1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-47285",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-15T18:37:27.011947Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-15T18:37:33.747Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vyper",
          "vendor": "vyperlang",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 0.4.2rc1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, `concat()` may skip evaluation of side effects when the length of an argument is zero. This is due to a fastpath in the implementation which skips evaluation of argument expressions when their length is zero. In practice, it would be very unusual in user code to construct zero-length bytestrings using an expression with side-effects, since zero-length bytestrings are typically constructed with the empty literal `b\"\"`; the only way to construct an empty bytestring which has side effects would be with the ternary operator introduced in v0.3.8, e.g. `b\"\" if self.do_some_side_effect() else b\"\"`. The fix is available in pull request 4644 and expected to be part of the 0.4.2 release. As a workaround, don\u0027t have side effects in expressions which construct zero-length bytestrings."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.9,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-691",
              "description": "CWE-691: Insufficient Control Flow Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-15T17:24:03.442Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vyperlang/vyper/security/advisories/GHSA-qhr6-mgqr-mchm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-qhr6-mgqr-mchm"
        },
        {
          "name": "https://github.com/vyperlang/vyper/pull/4644",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vyperlang/vyper/pull/4644"
        },
        {
          "name": "https://github.com/vyperlang/vyper/blob/68b68c4b30c5ef2f312b4674676170b8a6eaa316/vyper/builtins/functions.py#L560-L562",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vyperlang/vyper/blob/68b68c4b30c5ef2f312b4674676170b8a6eaa316/vyper/builtins/functions.py#L560-L562"
        }
      ],
      "source": {
        "advisory": "GHSA-qhr6-mgqr-mchm",
        "discovery": "UNKNOWN"
      },
      "title": "Vyper\u0027s `concat()` builtin may elide side-effects for zero-length arguments"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-47285",
    "datePublished": "2025-05-15T17:24:03.442Z",
    "dateReserved": "2025-05-05T16:53:10.374Z",
    "dateUpdated": "2025-05-15T18:37:33.747Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria

106 vulnerabilities by vyperlang

CVE-2026-114663 (GCVE-0-2026-114663)

CVE-2026-114118 (GCVE-0-2026-114118)

CVE-2026-114117 (GCVE-0-2026-114117)

CVE-2026-114116 (GCVE-0-2026-114116)

CVE-2026-114115 (GCVE-0-2026-114115)

CVE-2026-114114 (GCVE-0-2026-114114)

CVE-2021-48020 (GCVE-0-2021-48020)

CVE-2021-48019 (GCVE-0-2021-48019)

CVE-2021-48018 (GCVE-0-2021-48018)

CVE-2020-37289 (GCVE-0-2020-37289)

CVE-2020-37288 (GCVE-0-2020-37288)

CVE-2020-37287 (GCVE-0-2020-37287)

CVE-2020-37286 (GCVE-0-2020-37286)

CVE-2025-47774 (GCVE-0-2025-47774)

CVE-2025-47285 (GCVE-0-2025-47285)

CVE-2026-114663 (GCVE-0-2026-114663)

CVE-2026-114118 (GCVE-0-2026-114118)

CVE-2026-114117 (GCVE-0-2026-114117)

CVE-2026-114116 (GCVE-0-2026-114116)

CVE-2026-114115 (GCVE-0-2026-114115)

CVE-2026-114114 (GCVE-0-2026-114114)

CVE-2021-48020 (GCVE-0-2021-48020)

CVE-2021-48019 (GCVE-0-2021-48019)

CVE-2021-48018 (GCVE-0-2021-48018)

CVE-2020-37289 (GCVE-0-2020-37289)

CVE-2020-37288 (GCVE-0-2020-37288)

CVE-2020-37287 (GCVE-0-2020-37287)

CVE-2020-37286 (GCVE-0-2020-37286)

CVE-2025-47774 (GCVE-0-2025-47774)

CVE-2025-47285 (GCVE-0-2025-47285)