All vulnerabilities
CVE-2021-48019GHSA-375m-5fvv-xq23

Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies

vyperlang vyperPyPILibraries & packages
Open in ThreatlineRecord JSON
CVSS
6.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.25%Chance of exploitation activity in the next 30 days, higher than 15% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.2.9Fixed versionCVE List
Published21 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 0.2.9vyperCVE List
  • 0.2.9vyper, PyPIOSVpip install "vyper>=0.2.9"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data when a function returns more than 4096 bytes without return data sanitation, and fail strict return-size checks such as SafeERC20.safeTransfer.

Text from CVE List

Affected versions 28

  • vyperaffected: all versions before 0.2.9CVE List
  • vyperunaffected: 0.2.9CVE List
  • vyper, PyPIfrom first release, fixed in 0.2.9OSV
  • vyper, PyPI0.1.0b1OSV
  • vyper, PyPI0.1.0b10OSV
  • vyper, PyPI0.1.0b11OSV
  • vyper, PyPI0.1.0b12OSV
  • vyper, PyPI0.1.0b13OSV
  • vyper, PyPI0.1.0b14OSV
  • vyper, PyPI0.1.0b15OSV
  • vyper, PyPI0.1.0b16OSV
  • vyper, PyPI0.1.0b17OSV
  • vyper, PyPI0.1.0b2OSV
  • vyper, PyPI0.1.0b3OSV
  • vyper, PyPI0.1.0b4OSV
  • vyper, PyPI0.1.0b5OSV
  • vyper, PyPI0.1.0b6OSV
  • vyper, PyPI0.1.0b7OSV
  • vyper, PyPI0.1.0b8OSV
  • vyper, PyPI0.1.0b9OSV
  • vyper, PyPI0.2.1OSV
  • vyper, PyPI0.2.2OSV
  • vyper, PyPI0.2.3OSV
  • vyper, PyPI0.2.4OSV
  • vyper, PyPI0.2.5OSV
  • vyper, PyPI0.2.6OSV
  • vyper, PyPI0.2.7OSV
  • vyper, PyPI0.2.8OSV

References 2