{"id":"CVE-2021-48019","title":"Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies","summary":"Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data whe…","severity":"medium","cvss":4.8,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","cvssSource":"cna","cwe":["CWE-805"],"vendor":"vyperlang","product":"vyper","affected":["vyper < 0.2.9"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-27T21:35:49.406598Z"},"published":"2026-10-21","updated":"2026-10-27","sourceUpdated":"2026-10-27T21:35:59.282Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2021-48019","references":[{"url":"https://github.com/vyperlang/vyper/security/advisories/GHSA-375m-5fvv-xq23","label":"GitHub Security Advisory (GHSA-375m-5fvv-xq23)"},{"url":"https://www.vulncheck.com/advisories/vyper-before-0.2.9-incorrect-returndatasize-in-create-forwarder-to-proxies","label":"VulnCheck Advisory: Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies"},{"url":"https://github.com/vyperlang/vyper/pull/2281"},{"url":"https://pypi.org/project/vyper"}],"tags":["cve.org","osv","pip"],"epss":0.00248,"epssPercentile":0.15983,"aliases":["GHSA-375m-5fvv-xq23"],"ecosystem":"pip","patched":["vyper 0.2.9"],"ingestedAt":"2026-10-21T01:37:08.048Z","slug":"CVE-2021-48019","body":"## Overview\n\nVyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data when a function returns more than 4096 bytes without return data sanitation, and fail strict return-size checks such as SafeERC20.safeTransfer.\n\n## Affected\n\n- `vyper < 0.2.9`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2021-48019)\n\nAffected packages:\n\n- `vyper < 0.2.9`\n\nPatched in:\n\n- `vyper 0.2.9`\n\nSource: https://osv.dev/vulnerability/GHSA-375m-5fvv-xq23","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":26.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":230469,"id":"CVE-2021-48019","ts":1793138317493,"field":"severity","old":"low","new":"medium"},{"seq":228504,"id":"CVE-2021-48019","ts":1792843213987,"field":"severity","old":"medium","new":"low"}]}