All vulnerabilities
CVE-2020-37286GHSA-2r3x-4mrv-mcxf

Vyper 0.1.0b4 before 0.3.0 Memory Corruption via Nested Internal Function Calls

vyperlang vyperPyPILibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.3High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.28%Chance of exploitation activity in the next 30 days, higher than 19% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.3.0Also 0.2.6CVE List
Published21 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 0.3.0vyperCVE List
  • 0.2.6vyper, PyPIOSVpip install "vyper>=0.2.6"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested calls. Contracts using such calls as tuple elements, call arguments, or builtin arguments like concat or ecrecover can return corrupted values or pass wrong arguments to external calls.

Text from CVE List

Affected versions 25

  • vyperaffected: 0.1.0b4 before 0.3.0CVE List
  • vyperunaffected: 0.3.0CVE List
  • vyper, PyPIfrom first release, fixed in 0.2.6OSV
  • vyper, PyPI0.1.0b1OSV
  • vyper, PyPI0.1.0b10OSV
  • vyper, PyPI0.1.0b11OSV
  • vyper, PyPI0.1.0b12OSV
  • vyper, PyPI0.1.0b13OSV
  • vyper, PyPI0.1.0b14OSV
  • vyper, PyPI0.1.0b15OSV
  • vyper, PyPI0.1.0b16OSV
  • vyper, PyPI0.1.0b17OSV
  • vyper, PyPI0.1.0b2OSV
  • vyper, PyPI0.1.0b3OSV
  • vyper, PyPI0.1.0b4OSV
  • vyper, PyPI0.1.0b5OSV
  • vyper, PyPI0.1.0b6OSV
  • vyper, PyPI0.1.0b7OSV
  • vyper, PyPI0.1.0b8OSV
  • vyper, PyPI0.1.0b9OSV
  • vyper, PyPI0.2.1OSV
  • vyper, PyPI0.2.2OSV
  • vyper, PyPI0.2.3OSV
  • vyper, PyPI0.2.4OSV
  • vyper, PyPI0.2.5OSV

References 2