vyper vulnerabilities
CVEs whose affected-version data names the vyper package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
36 CVEsRSS
CVE-2026-114663High· 8.4Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments
Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's param…
CVE-2020-37286Medium· 6.5Vyper 0.1.0b4 before 0.3.0 Memory Corruption via Nested Internal Function Calls
Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested calls. Contracts using such calls as tuple elements, call arg…
CVE-2020-37289Low· 3.7Vyper before 0.3.1 Improper Input Validation of uint8 Interface Return Values
Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decimals(), to be stored in uint256 variables without bounds checking. Malicious contracts can return values greater than 255 to man…
CVE-2020-37287Medium· 5.9Vyper before 0.2.6 Call Stack Corruption via Complex Type Function Arguments
Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passed as arguments. Contracts passing multi-dimensional arrays or structs to internal …
CVE-2021-48020Medium· 6.5Vyper before 0.3.0 Memory Corruption via Internal Function Calls in Arrays
Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are performed inside arrays. Contracts placing internal calls in nested array elements, exte…
CVE-2021-48019Medium· 4.8Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies
Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data whe…
CVE-2026-114114Medium· 5.3PoCVyper through 0.5.0b1 Literal Value Substitution via Multi-byte Characters
Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct la…
CVE-2026-114117Medium· 5.9PoCVyper 0.3.8 through 0.5.0b1 Optimizer Miscompilation of msg.value | K in Ternary Branches
Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas…
CVE-2026-114116Medium· 5.3PoCVyper through 0.5.0b1 Literal Value Manipulation via Line Separators
Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified an…
CVE-2026-114115Low· 3.7Vyper 0.3.8 through 0.5.0b1 Memory Misread via Ternary Nested Array Selection
Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that reads nested arrays with narrower inner bounds using the wider result type's memory layout. When a ternary selects the narrower array, inner…
CVE-2026-114118Medium· 4.8Vyper 0.3.4 through 0.5.0b1 create_from_blueprint Offset Validation Bypass via Unsigned Wraparound
Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by uint256 subtraction without first checking that code_offset is below the blueprint's code size, so a huge offset wraps to a small positive valu…
CVE-2020-37288Medium· 3.7Vyper: Return inside for loop more than 1 level deep
Vyper: Return inside for loop more than 1 level deep
GHSA-vg88-3v92-rjx2MediumVyper: Return inside for loop more than 1 level deep
Vyper: Return inside for loop more than 1 level deep
GHSA-4v7v-gqf9-ww2gMediumVyper: Call stack corruption when passing complex type containing non-base type members as argument
Vyper: Call stack corruption when passing complex type containing non-base type members as argument
GHSA-2r3x-4mrv-mcxfMediumVyper: Memory corruption using function calls within tuples / nested calls
Vyper: Memory corruption using function calls within tuples / nested calls
CVE-2025-47285LowVyper's `concat()` builtin may elide side-effects for zero-length arguments
Vyper's `concat()` builtin may elide side-effects for zero-length arguments
CVE-2025-47774LowVyper's `slice()` may elide side-effects when output length is 0
Vyper's `slice()` may elide side-effects when output length is 0
CVE-2025-21607LowVyper Does Not Check the Success of Certain Precompile Calls
Vyper Does Not Check the Success of Certain Precompile Calls
CVE-2024-24563Critical· 9.8Vyper negative array index bounds checks
Vyper negative array index bounds checks
CVE-2024-24559Low· 3.7Vyper sha3 codegen bug
Vyper sha3 codegen bug
CVE-2024-24560Low· 3.7Vyper's external calls can overflow return data to return input buffer
Vyper's external calls can overflow return data to return input buffer
CVE-2024-24561Critical· 9.8Vyper's bounds check on built-in `slice()` function can be overflowed
Vyper's bounds check on built-in `slice()` function can be overflowed
CVE-2024-24567Medium· 4.8Vyper's raw_call `value=` kwargs not disabled for static and delegate calls
Vyper's raw_call `value=` kwargs not disabled for static and delegate calls
CVE-2024-22419High· 7.3concat built-in can corrupt memory in vyper
concat built-in can corrupt memory in vyper
CVE-2023-46247High· 7.5incorrect storage layout for contracts containing large arrays
incorrect storage layout for contracts containing large arrays
CVE-2023-42441Medium· 5.3Vyper has incorrect re-entrancy lock when key is empty string
Vyper has incorrect re-entrancy lock when key is empty string
CVE-2023-41052Medium· 5.3incorrect order of evaluation of side effects for some builtins
incorrect order of evaluation of side effects for some builtins
CVE-2023-39363High· 8.7Vyper has incorrectly allocated named re-entrancy locks
Vyper has incorrectly allocated named re-entrancy locks
CVE-2023-32059High· 7.5Vyper vulnerable to incorrect ordering of arguments for kwargs passed to internal calls
Vyper vulnerable to incorrect ordering of arguments for kwargs passed to internal calls
CVE-2023-32058High· 7.5Vyper vulnerable to integer overflow in loop
Vyper vulnerable to integer overflow in loop