All vulnerabilities
CVE-2021-48020GHSA-22wc-c9wj-6q2v

Vyper before 0.3.0 Memory Corruption via Internal Function Calls in Arrays

vyperlang vyperPyPILibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.3High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.28%Chance of exploitation activity in the next 30 days, higher than 19% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.3.0Also 0.2.12CVE List
Published21 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 0.3.0vyperCVE List
  • 0.2.12vyper, PyPIOSVpip install "vyper>=0.2.12"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are performed inside arrays. Contracts placing internal calls in nested array elements, external call arguments, struct literals, or raw_log topics can have memory corrupted, producing incorrect contract behavior.

Text from CVE List

Affected versions 31

  • vyperaffected: 0.1.0b4 before 0.3.0CVE List
  • vyperunaffected: 0.3.0CVE List
  • vyper, PyPIfrom first release, fixed in 0.2.12OSV
  • vyper, PyPI0.1.0b1OSV
  • vyper, PyPI0.1.0b10OSV
  • vyper, PyPI0.1.0b11OSV
  • vyper, PyPI0.1.0b12OSV
  • vyper, PyPI0.1.0b13OSV
  • vyper, PyPI0.1.0b14OSV
  • vyper, PyPI0.1.0b15OSV
  • vyper, PyPI0.1.0b16OSV
  • vyper, PyPI0.1.0b17OSV
  • vyper, PyPI0.1.0b2OSV
  • vyper, PyPI0.1.0b3OSV
  • vyper, PyPI0.1.0b4OSV
  • vyper, PyPI0.1.0b5OSV
  • vyper, PyPI0.1.0b6OSV
  • vyper, PyPI0.1.0b7OSV
  • vyper, PyPI0.1.0b8OSV
  • vyper, PyPI0.1.0b9OSV
  • vyper, PyPI0.2.1OSV
  • vyper, PyPI0.2.10OSV
  • vyper, PyPI0.2.11OSV
  • vyper, PyPI0.2.2OSV
  • vyper, PyPI0.2.3OSV
  • vyper, PyPI0.2.4OSV
  • vyper, PyPI0.2.5OSV
  • vyper, PyPI0.2.6OSV
  • vyper, PyPI0.2.7OSV
  • vyper, PyPI0.2.8OSV
  • vyper, PyPI0.2.9OSV

References 2