{"schema":"threatline.record/2","record":{"id":"GHSA-4v7v-gqf9-ww2g","aliases":["GHSA-4v7v-gqf9-ww2g"],"summary":"Vyper: Call stack corruption when passing complex type containing non-base type members as argument","details":"### Impact\nWhen we pass a multi-dimensional array (like `[[1, 2], [3, 4]]`) as an argument to internal/external functions we get incorrect output. This is due to a stack management issue, because it was assumed that the size of each subtype of an array/struct is 32, which is not always correct.\n\nExample code:\n```python\n@internal\ndef test_input(arr: int128[2][1], i: int128) -> (int128[2][1], int128):\n    return arr, i\n\n@external\ndef test_values(arr: int128[2][1], i: int128) -> (int128[2][1], int128):\n    return self.test_input(arr, i)\n```\n\nPlease see #2183 for further information\n\n### Patches\nThis problem was fixed in #2184, and released as a part of [`v0.2.6`](https://github.com/vyperlang/vyper/releases/tag/v0.2.6).","categories":["Libraries & packages"],"product":"vyper","vendor":"","ecosystem":"pip","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-4v7v-gqf9-ww2g","source_modified_at":"2026-10-06T15:22:24Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"vyper"},"range":"< 0.2.6"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-4v7v-gqf9-ww2g","source_modified_at":"2026-10-06T15:30:03.646574259Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"vyper","ecosystem":"PyPI","purl":"pkg:pypi/vyper"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.6"}]}],"versions":["0.1.0b1","0.1.0b10","0.1.0b11","0.1.0b12","0.1.0b13","0.1.0b14","0.1.0b15","0.1.0b16","0.1.0b17","0.1.0b2","0.1.0b3","0.1.0b4","0.1.0b5","0.1.0b6","0.1.0b7","0.1.0b8","0.1.0b9","0.2.1","0.2.2","0.2.3","0.2.4","0.2.5"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-4v7v-gqf9-ww2g","source_modified_at":"2026-10-06T15:22:24Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"vyper"},"version":"0.2.6"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-4v7v-gqf9-ww2g","source_modified_at":"2026-10-06T15:30:03.646574259Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"vyper","ecosystem":"PyPI","purl":"pkg:pypi/vyper"},"version":"0.2.6"}],"cvss":6.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-06T15:22:23Z","modified_at":"2026-10-06T15:30:03.646574259Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-4v7v-gqf9-ww2g","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-06T15:22:24Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-4v7v-gqf9-ww2g","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-06T15:30:03.646574259Z"}],"sources":["GitHub Advisory Database","OSV"],"references":[{"url":"https://github.com/vyperlang/vyper/security/advisories/GHSA-4v7v-gqf9-ww2g","source":"GitHub Advisory Database"},{"url":"https://github.com/vyperlang/vyper/issues/2183","source":"GitHub Advisory Database"},{"url":"https://github.com/vyperlang/vyper/pull/2184","source":"GitHub Advisory Database"},{"url":"https://github.com/vyperlang/vyper/commit/0be02b7331e8febe79d5a4218829c72e30417a29","source":"GitHub Advisory Database"},{"url":"https://github.com/vyperlang/vyper/releases/tag/v0.2.6","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-4v7v-gqf9-ww2g","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-06T15:30:03.646574259Z","content_hash":"f349b43f9191f5c3e20415c1958cfc9a46392f897501484d376cac9152223195"}}