Read the docs
TI-2022-26511 Aliases GHSA-7vrm-3jc8-5wwm

Incorrect Comparison in Vyper

Priority LOW 38CWE-697Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

### Impact bytestrings can have dirty bytes in them, resulting in the word-for-word comparison to give incorrect results, e.g. ```vyper b1: Bytes[32] = b"abcdef" b1 = slice(b1, 0, 1) b2: Bytes[32] = b"abcdef" t: bool = b1 == b2 # incorrectly evaluates to True ``` even without dirty nonzero bytes, because there is no comparison of the length, two bytestrings can compare to equal if one ends with `"\x00"`. ```vyper b1: Bytes[32] = b"abc\0" b2: Bytes[32] = b"abc" t: bool = b1 == b2 # incorrectly evaluates to True ``` ### Patches fixed in https://github.com/vyperlang/vyper/commit/2c73f8352635c0a433423a5b94740de1a118e508

Why it matters now

Fix Fixed vyper (PyPI): 0.3.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—vyper (PyPI)before 0.3.20.3.2Patch availableGHSA-7vrm-3jc8-5wwm
  • vyper (PyPI) Vendor— Affected before 0.3.2 Fixed in 0.3.2 Patch available GHSA-7vrm-3jc8-5wwm

Remediation

  • Fix · GHSA-7vrm-3jc8-5wwm vyper (PyPI) Fixed in 0.3.2 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-7vrm-3jc8-5wwm

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences