All vulnerabilities
CVE-2020-37287GHSA-4v7v-gqf9-ww2g

Vyper before 0.2.6 Call Stack Corruption via Complex Type Function Arguments

vyperlang vyperPyPILibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.2High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.25%Chance of exploitation activity in the next 30 days, higher than 15% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.2.6Fixed versionCVE List
Published21 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 0.2.6vyperCVE List
  • 0.2.6vyper, PyPIOSVpip install "vyper>=0.2.6"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passed as arguments. Contracts passing multi-dimensional arrays or structs to internal or external functions receive corrupted values because the compiler assumed each subtype size is 32.

Text from CVE List

Affected versions 25

  • vyperaffected: all versions before 0.2.6CVE List
  • vyperunaffected: 0.2.6CVE List
  • vyper, PyPIfrom first release, fixed in 0.2.6OSV
  • vyper, PyPI0.1.0b1OSV
  • vyper, PyPI0.1.0b10OSV
  • vyper, PyPI0.1.0b11OSV
  • vyper, PyPI0.1.0b12OSV
  • vyper, PyPI0.1.0b13OSV
  • vyper, PyPI0.1.0b14OSV
  • vyper, PyPI0.1.0b15OSV
  • vyper, PyPI0.1.0b16OSV
  • vyper, PyPI0.1.0b17OSV
  • vyper, PyPI0.1.0b2OSV
  • vyper, PyPI0.1.0b3OSV
  • vyper, PyPI0.1.0b4OSV
  • vyper, PyPI0.1.0b5OSV
  • vyper, PyPI0.1.0b6OSV
  • vyper, PyPI0.1.0b7OSV
  • vyper, PyPI0.1.0b8OSV
  • vyper, PyPI0.1.0b9OSV
  • vyper, PyPI0.2.1OSV
  • vyper, PyPI0.2.2OSV
  • vyper, PyPI0.2.3OSV
  • vyper, PyPI0.2.4OSV
  • vyper, PyPI0.2.5OSV

References 2