vyperlang

Records53All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical7CVSS 9.0–10.0

CVSS high16CVSS 7.0–8.9

Exploited now

vyperlang records in CISA KEV

No vyperlang vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Vyper 38 records HIGH

Records

53 records

TI-2024-16182 CVE-2024-24561 · GHSA-9x7f-gwxq-6f2c

Vyper bounds check on built-in `slice()` function can be overflowed

HIGH 82

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00902 Published 2024-02-01 Fixed in 0.4.0 CWE-119

TI-2024-14992 CVE-2024-22419 · GHSA-2q8v-3gqq-4f8p

concat built-in can corrupt memory in vyper

HIGH 81

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0077 Published 2024-01-18 Fixed in 0.4.0 CWE-120

TI-2024-16184 CVE-2024-24563 · GHSA-52xq-j7v9-v4v2

Vyper array negative index vulnerability

HIGH 76

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01539 Published 2024-02-07 Fixed in 0.4.0 CWE-129

TI-2022-08657 CVE-2022-24845 · GHSA-j2x6-9323-fp7h

Integer bounds error in Vyper

HIGH 76

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01426 Published 2022-04-13 Fixed in 0.3.2 CWE-190

TI-2022-11796 CVE-2022-29255 · GHSA-4v9q-cgpw-cf38

Multiple evaluation of contract address in call in vyper

HIGH 75

Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.01349 Published 2022-06-06 Fixed in 0.3.4 CWE-670

TI-2026-78730 CVE-2026-114117

Optimizer miscompilation of msg.value | K in Vyper ternary branches

HIGH 69

Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression br…

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00294 Published 2026-10-21 No fix listed CWE-682

TI-2024-21531 CVE-2024-32649 · GHSA-5jrj-52x8-m64h

vyper performs double eval of the argument of sqrt

MEDIUM 63

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00451 Published 2024-04-25 Fixed in 0.4.0 CWE-95

TI-2024-21527 CVE-2024-32645 · GHSA-xchq-w5r3-4wg3

vyper performs incorrect topic logging in raw_log

MEDIUM 63

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00451 Published 2024-04-25 Fixed in 0.4.0 CWE-20

TI-2024-21375 CVE-2024-32481 · GHSA-ppx5-q359-pvwj

vyper's range(start, start + N) reverts for negative numbers

MEDIUM 63

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00791 Published 2024-04-25 Fixed in 0.4.0b1, 0.4.0 CWE-681

TI-2024-16181 CVE-2024-24560 · GHSA-gp3w-2v2m-p686

Vyper external calls can overflow return data to return input buffer

MEDIUM 63

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00526 Published 2024-02-02 Fixed in 0.4.0 CWE-119

TI-2026-78729 CVE-2026-114116

Vyper misreads numeric literals when source has line separators

MEDIUM 60

Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals…

CVSS 4.0MEDIUM 6.0 Network No auth User interaction EPSS 0.0026 Published 2026-10-21 Fixed in 0.1.0b17 CWE-436

TI-2026-78727 CVE-2026-114114

Vyper multi-byte characters let attackers substitute literals

MEDIUM 60

Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used…

CVSS 4.0MEDIUM 6.0 Network No auth User interaction EPSS 0.0026 Published 2026-10-21 Fixed in 0.1.0b12, 0.1.0b15 CWE-176

TI-2024-21529 CVE-2024-32647 · GHSA-3whq-64q2-qfj6

vyper performs double eval of raw_args in create_from_blueprint

MEDIUM 57

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00451 Published 2024-04-25 Fixed in 0.4.0 CWE-95

TI-2024-21528 CVE-2024-32646 · GHSA-r56x-j438-vw5m

vyper performs double eval of the slice args when buffer from adhoc locations

MEDIUM 57

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00451 Published 2024-04-25 Fixed in 0.4.0 CWE-20

TI-2024-17239 CVE-2024-26149 · GHSA-9p8r-4xp4-gw5w

Vyper _abi_decode Memory Overflow

MEDIUM 57

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00542 Published 2024-02-26 Fixed in 0.4.0 CWE-119

TI-2024-16188 CVE-2024-24567 · GHSA-x2c2-q32w-4w6m

raw_call `value=` kwargs not disabled for static and delegate calls

MEDIUM 57

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00485 Published 2024-01-30 Fixed in 0.4.0 CWE-754

TI-2024-16185 CVE-2024-24564 · GHSA-4hwq-4cpm-8vmx

Vyper extract32 can ready dirty memory

MEDIUM 57

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00561 Published 2024-02-26 Fixed in 0.4.0 CWE-125

TI-2024-16180 CVE-2024-24559 · GHSA-6845-xw22-ffxv

Vyper SHA3 code generation bug

MEDIUM 57

Vyper is a Pythonic Smart Contract Language for the EVM.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00255 Published 2024-02-05 Fixed in 0.4.0 CWE-327

TI-2023-14856 CVE-2023-31146 · GHSA-3p37-3636-q8wv

Vyper vulnerable to OOB DynArray access when array is on both LHS and RHS of an assignment

MEDIUM 48

Vyper is a Pythonic smart contract language for the Ethereum virtual machine.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01252 Published 2023-05-11 Fixed in 0.3.8 CWE-787

TI-2025-15567 CVE-2025-21607 · GHSA-vgf2-gvx8-xwc3

Success of Certain Precompile Calls not Checked in Vyper

MEDIUM 45

Vyper is a Pythonic Smart Contract Language for the EVM.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00666 Published 2025-01-14 Fixed in 0.4.1 CWE-670

TI-2022-08601 CVE-2022-24788 · GHSA-4mrx-6fxm-8jpg

Buffer overflow in Vyper

MEDIUM 44

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00986 Published 2022-04-13 Fixed in 0.3.2 CWE-120

TI-2023-20502 CVE-2023-39363 · GHSA-5824-cm3x-3c38

Vyper incorrectly allocated named re-entrancy locks

MEDIUM 41

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM).

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00821 Published 2023-08-07 Fixed in 0.3.1 CWE-863

TI-2023-15362 CVE-2023-32058 · GHSA-6r8q-pfpv-7cgj

Vyper vulnerable to integer overflow in loop

MEDIUM 41

Vyper is a Pythonic smart contract language for the Ethereum virtual machine.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00913 Published 2023-05-11 Fixed in 0.3.8 CWE-190

TI-2023-14445 CVE-2023-30629 · GHSA-w9g2-3w7p-72g9

Vyper's raw_call with outsize=0 and revert_on_failure=False returns incorrect success value

MEDIUM 41

Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00883 Published 2023-04-24 Fixed in 0.3.8 CWE-670

TI-2022-08600 CVE-2022-24787

Incorrect Comparison in Vyper

MEDIUM 41

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01029 Published 2022-04-04 No fix listed CWE-697

Open these records in search →

Critical	7
High	16
Medium	24
Low	6
No CVSS	0