Read the docs
TI-2021-17960 Aliases CVE-2021-41121GHSA-xv8x-pr4h-73jv

Memory corruption in Vyper

Priority MEDIUM 40CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-119 and the CVSS impact.

Summary

Vyper is a Pythonic Smart Contract Language for the EVM. In affected versions when performing a function call inside a literal struct, there is a memory corruption issue that occurs because of an incorrect pointer to the the top of the stack. This issue has been resolved in version 0.3.0.

Why it matters now

EPSS 0.01074 65th percentileScored 2026-11-07
Fix Fixed vyper (vyperlang): 0.3.0vyper (PyPI): 0.3.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
vyperlangvyperbefore 0.3.00.3.0Patch availableCNA
—vyper (PyPI)before 0.3.00.3.0Patch availableGHSA-xv8x-pr4h-73jv
  • vyper Vendorvyperlang Affected before 0.3.0 Fixed in 0.3.0 Patch available CNA
  • vyper (PyPI) Vendor— Affected before 0.3.0 Fixed in 0.3.0 Patch available GHSA-xv8x-pr4h-73jv

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*before 0.3.0Vulnerablevyperlang
  • cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:* Versions before 0.3.0 Vulnerable ·vyperlang

Remediation

  • Fix · CNA vyper (vyperlang) Fixed in 0.3.0
  • Fix · GHSA-xv8x-pr4h-73jv vyper (PyPI) Fixed in 0.3.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-41121
  2. 2026-10-03 Alias added: GHSA-xv8x-pr4h-73jv

References

Patch 1

Advisory 2

Other 2

  • TI-2024-16182 Vyper bounds check on built-in `slice()` function can be overflowed CVSS 3.1CRITICAL 9.8
  • TI-2024-14992 concat built-in can corrupt memory in vyper CVSS 3.1CRITICAL 9.8
  • TI-2024-16184 Vyper array negative index vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2022-08657 Integer bounds error in Vyper CVSS 3.1CRITICAL 9.8
  • TI-2022-11796 Multiple evaluation of contract address in call in vyper CVSS 3.1HIGH 8.2
  • TI-2024-21531 vyper performs double eval of the argument of sqrt CVSS 3.1MEDIUM 5.3
See all 37 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences