- Latest release
- 0.4.3 (Jun 18, 2025): affected by 2 advisories
- Newest unaffected release
- Every release is affected by at least one advisory
- Advisories
- 47 · 3 critical, 17 high, 14 medium, 13 low
- Weekly downloads
- 30.6K
- Dependents
- 36
- Releases
- 79 since 0.2.1 (Jul 3, 2020)
- Registry
- PyPI
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2021-48020Affects 0.1.0b1 to 0.2.11 (0.2.12 is outside it)
- CVE-2021-48019Affects 0.1.0b1 to 0.2.8 (0.2.9 is outside it)
- CVE-2021-48018Affects 0.2.13 to 0.2.14 (0.2.15 is outside it)
- CVE-2020-37289Affects 0.1.0b1 to 0.1.0b16 (0.1.0b17 is outside it)
- CVE-2020-37288Affects 0.1.0b10 to 0.2.2 (0.2.3 is outside it)
- CVE-2020-37287Affects 0.1.0b1 to 0.2.5 (0.2.6 is outside it)
- CVE-2020-37286Affects 0.1.0b1 to 0.2.5 (0.2.6 is outside it)
- CVE-2025-47774Affects 0.1.0b1 to 0.4.2rc1 (0.4.2 is outside it)
- CVE-2025-47285Affects 0.1.0b1 to 0.4.2rc1 (0.4.2 is outside it)
- CVE-2025-26622Affects 0.1.0b1 to 0.4.1rc3 (0.4.1 is outside it)
- CVE-2025-27104Affects 0.1.0b1 to 0.4.1rc3 (0.4.1 is outside it)
- CVE-2025-27105Affects 0.1.0b1 to 0.4.1rc3 (0.4.1 is outside it)
Show all 47 advisoriesShow fewer advisories
- CVE-2025-21607Affects 0.1.0b1 to 0.5.0b2 (through the newest release)
- CVE-2024-32649Affects 0.1.0b1 to 0.4.0rc6 (0.4.0 is outside it)
- CVE-2024-32648Affects 0.1.0b1 to 0.2.16 (0.3.0 is outside it)
- CVE-2024-32647Affects 0.1.0b1 to 0.4.0rc6 (0.4.0 is outside it)
- CVE-2024-32646Affects 0.1.0b1 to 0.4.0rc6 (0.4.0 is outside it)
- CVE-2024-32645Affects 0.1.0b1 to 0.4.0rc6 (0.4.0 is outside it)
- CVE-2024-32481Affects 0.3.8 to 0.4.0rc6 (0.4.0 is outside it)
- CVE-2024-24564Its ranges can't be placed on these versionsIts ranges can't be placed on these versions
- CVE-2024-26149Affects 0.1.0b1 to 0.4.0rc6 (0.4.0 is outside it)
- CVE-2024-24563Affects 0.1.0b1 to 0.4.0rc6 (0.4.0 is outside it)
- CVE-2024-24559Affects 0.1.0b1 to 0.4.0rc6 (0.4.0 is outside it)
- CVE-2024-24560Affects 0.1.0b1 to 0.4.0rc6 (0.4.0 is outside it)
- CVE-2024-24561Affects 0.1.0b1 to 0.4.0rc6 (0.4.0 is outside it)
- CVE-2024-24567Affects 0.1.0b1 to 0.4.0rc6 (0.4.0 is outside it)
- CVE-2024-22419Affects 0.1.0b1 to 0.4.0rc6 (0.4.0 is outside it)
- CVE-2023-46247Affects 0.1.0b1 to 0.3.7 (0.3.8 is outside it)
- CVE-2023-42460Affects 0.3.4 to 0.3.10rc5 (0.3.10 is outside it)
- CVE-2023-42443Affects 0.1.0b1 to 0.3.10rc5 (0.3.10 is outside it)
- CVE-2023-42441Affects 0.2.9 to 0.3.10rc5 (0.3.10 is outside it)
- CVE-2023-40015Affects 0.1.0b1 to 0.4.2 (0.4.3rc1 is outside it)
- CVE-2023-41052Affects 0.1.0b1 to 0.3.10rc5 (0.3.10 is outside it)
- CVE-2023-39363Affects 0.1.0b1 to 0.5.0b2 (through the newest release)
- CVE-2023-37902Affects 0.1.0b1 to 0.3.10rc5 (0.3.10 is outside it)
- CVE-2023-32675Affects 0.1.0b1 to 0.3.7 (0.3.8 is outside it)
- CVE-2023-32059Affects 0.1.0b1 to 0.3.7 (0.3.8 is outside it)
- CVE-2023-32058Affects 0.1.0b1 to 0.3.7 (0.3.8 is outside it)
- CVE-2023-31146Affects 0.1.0b1 to 0.3.7 (0.3.8 is outside it)
- CVE-2023-30837Affects 0.1.0b1 to 0.3.7 (0.3.8 is outside it)
- CVE-2023-30629Affects 0.3.1 to 0.3.7 (0.3.8 is outside it)
- CVE-2022-29255Affects 0.1.0b1 to 0.3.3 (0.3.4 is outside it)
- CVE-2022-24845Affects 0.1.0b1 to 0.3.1 (0.3.2 is outside it)
- CVE-2022-24788Affects 0.1.0b1 to 0.3.1 (0.3.2 is outside it)
- CVE-2022-24787Affects 0.1.0b1 to 0.3.1 (0.3.2 is outside it)
- CVE-2021-41121Affects 0.1.0b1 to 0.2.16 (0.3.0 is outside it)
- CVE-2021-41122Affects 0.1.0b1 to 0.2.16 (0.3.0 is outside it)
Advisories 47
- CVE-2021-48020High 8.3
Vyper before 0.3.0 Memory Corruption via Internal Function Calls in Arrays
Affected: fixed in 0.2.12.
Fixed in 0.2.12 (released Apr 16, 2021, 2014 days before disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2021-48019Medium 6.3
Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies
Affected: fixed in 0.2.9.
Fixed in 0.2.9 (released Feb 17, 2021, 2072 days before disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2021-48018High 8.3
Vyper 0.2.13 before 0.2.15 Storage Corruption via @nonreentrant Decorator
Affected: from 0.2.13, fixed in 0.2.15.
Fixed in 0.2.15 (released Jul 24, 2021, 1915 days before disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2020-37289Medium 6.3
Vyper before 0.3.1 Improper Input Validation of uint8 Interface Return Values
Affected: through 0.1.0b16.
Fixed in 0.2.1 (released Jul 3, 2020, 2301 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 0.4.3, is not affected.
- CVE-2020-37288Medium 6.3
Vyper 0.1.0b10 before 0.2.3 Invalid Jump Destination via Return in Nested Loops
Affected: from 0.1.0b10, fixed in 0.2.3.
Fixed in 0.2.3 (released Jul 16, 2020, 2288 days before disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2020-37287High 8.2
Vyper before 0.2.6 Call Stack Corruption via Complex Type Function Arguments
Affected: fixed in 0.2.6.
Fixed in 0.2.6 (released Oct 10, 2020, 2202 days before disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2020-37286High 8.3
Vyper 0.1.0b4 before 0.3.0 Memory Corruption via Nested Internal Function Calls
Affected: fixed in 0.2.6.
Fixed in 0.2.6 (released Oct 10, 2020, 2202 days before disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2025-47774Low 2.9
Vyper's `slice()` may elide side-effects when output length is 0
Affected: through 0.4.2rc1.
Fixed in 0.4.2 (released May 31, 2025, 16 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 0.4.3, is not affected.
- CVE-2025-47285Low 2.9
Vyper's `concat()` builtin may elide side-effects for zero-length arguments
Affected: through 0.4.2rc1.
Fixed in 0.4.2 (released May 31, 2025, 16 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 0.4.3, is not affected.
- CVE-2025-26622Low 2.3
sqrt doesn't define rounding behavior in Vyper
Affected: fixed in 0.4.1.
Fixed in 0.4.1 (released Mar 1, 2025, 8 days after disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2025-27104Low 2.3
double eval in For List Iter in Vyper
Affected: fixed in 0.4.1.
Fixed in 0.4.1 (released Mar 1, 2025, 8 days after disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2025-27105Low 2.3
AugAssign evaluation order causing OOB write within the object in Vyper
Affected: fixed in 0.4.1.
Fixed in 0.4.1 (released Mar 1, 2025, 8 days after disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2025-21607Low 2.3
Success of Certain Precompile Calls not Checked in Vyper
Affected: all versions; fixed in 0.4.1.
No fix released. The latest release, 0.4.3, is still affected.
- CVE-2024-32649Medium 5.3
vyper performs double eval of the argument of sqrt
Affected: fixed in 0.4.0.
Fixed in 0.4.0 (released Jun 20, 2024, 56 days after disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2024-32648Medium 5.3
vyper default functions don't respect nonreentrancy keys
Affected: fixed in 0.3.0; fixed in 0.3.0.
Fixed in 0.3.0 (released Oct 5, 2021, 933 days before disclosure).
The latest release, 0.4.3, is not affected.
Show all 47 advisoriesShow fewer advisories
- CVE-2024-32647Medium 5.3
vyper performs double eval of raw_args in create_from_blueprint
Affected: fixed in 0.4.0.
Fixed in 0.4.0 (released Jun 20, 2024, 56 days after disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2024-32646Medium 5.3
vyper performs double eval of the slice args when buffer from adhoc locations
Affected: fixed in 0.4.0.
Fixed in 0.4.0 (released Jun 20, 2024, 56 days after disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2024-32645Medium 5.3
vyper performs incorrect topic logging in raw_log
Affected: fixed in 0.4.0.
Fixed in 0.4.0 (released Jun 20, 2024, 56 days after disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2024-32481Medium 5.3
vyper's range(start, start + N) reverts for negative numbers
Affected: from 0.3.8, fixed in 0.4.0; from 0.3.8, fixed in 0.4.0b1.
Fixed in 0.4.0 (released Jun 20, 2024, 56 days after disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2024-24564Low 3.7
Vyper extract32 can ready dirty memory
Affected: fixed in 0.4.0; fixed in 0.4.0.
- CVE-2024-26149Low 3.7
Vyper _abi_decode Memory Overflow
Affected: fixed in 0.4.0; fixed in 0.4.0b1.
Fixed in 0.4.0 (released Jun 20, 2024, 115 days after disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2024-24563Critical 9.8
Vyper array negative index vulnerability
Affected: fixed in 0.4.0b1; fixed in 0.4.0.
Fixed in 0.4.0 (released Jun 20, 2024, 134 days after disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2024-24559Low 3.7
Vyper SHA3 code generation bug
Affected: fixed in 0.4.0b1; fixed in 0.4.0.
Fixed in 0.4.0 (released Jun 20, 2024, 136 days after disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2024-24560Low 3.7
Vyper external calls can overflow return data to return input buffer
Affected: fixed in 0.4.0b1; fixed in 0.4.0.
Fixed in 0.4.0 (released Jun 20, 2024, 139 days after disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2024-24561Critical 9.8
Vyper bounds check on built-in `slice()` function can be overflowed
Affected: fixed in 0.4.0; fixed in 0.4.0b1.
Fixed in 0.4.0 (released Jun 20, 2024, 140 days after disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2024-24567Medium 4.8
raw_call `value=` kwargs not disabled for static and delegate calls
Affected: fixed in 0.4.0b1; fixed in 0.4.0.
Fixed in 0.4.0 (released Jun 20, 2024, 142 days after disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2024-22419High 7.3
concat built-in can corrupt memory in vyper
Affected: from 0.3.0, fixed in 0.4.0; fixed in 0.4.0b1.
Fixed in 0.4.0 (released Jun 20, 2024, 154 days after disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2023-46247High 7.5
Vyper has incorrect storage layout for contracts containing large arrays
Affected: fixed in 0.3.8.
Fixed in 0.3.8 (released May 23, 2023, 204 days before disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2023-42460Medium 5.3
_abi_decode input not validated in complex expressions in Vyper
Affected: from 0.3.4, fixed in 0.3.10.
Fixed in 0.3.10 (released Oct 4, 2023, 8 days after disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2023-42443High 8.1
Vyper vulnerable to memory corruption in certain builtins utilizing `msize`
Affected: fixed in 0.3.10; from 0.3.4, fixed in 0.3.10.
Fixed in 0.3.10 (released Oct 4, 2023, 16 days after disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2023-42441Medium 5.3
Vyper has incorrect re-entrancy lock when key is empty string
Affected: from 0.2.9, fixed in 0.3.10.
Fixed in 0.3.10 (released Oct 4, 2023, 16 days after disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2023-40015Low 3.7
Vyper: reversed order of side effects for some operations
Affected: fixed in 0.3.10rc1; through 0.4.2.
Fixed in 0.4.3 (released Jun 18, 2025, 653 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 0.4.3, is not affected.
- CVE-2023-41052Low 3.7
Vyper: incorrect order of evaluation of side effects for some builtins
Affected: fixed in 0.3.10; fixed in 0.3.10rc1.
Fixed in 0.3.10 (released Oct 4, 2023, 30 days after disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2023-39363Critical 9.1
Vyper incorrectly allocated named re-entrancy locks
Affected: all versions; from 0.2.15, fixed in 0.3.1.
No fix released. The latest release, 0.4.3, is still affected.
- CVE-2023-37902Medium 5.3
Vyper's ecrecover can return undefined data if signature does not verify
Affected: fixed in 0.3.10; fixed in 0.3.9.
Fixed in 0.3.10 (released Oct 4, 2023, 71 days after disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2023-32675Low 3.7
Nonpayable default functions are sometimes payable in vyper
Affected: fixed in 0.3.8.
Fixed in 0.3.8 (released May 23, 2023, 4 days after disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2023-32059High 7.5
Vyper vulnerable to incorrect ordering of arguments for kwargs passed to internal calls
Affected: fixed in 0.3.8.
Fixed in 0.3.8 (released May 23, 2023, 12 days after disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2023-32058High 7.5
Vyper vulnerable to integer overflow in loop
Affected: fixed in 0.3.8.
Fixed in 0.3.8 (released May 23, 2023, 12 days after disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2023-31146High 7.5
Vyper vulnerable to OOB DynArray access when array is on both LHS and RHS of an assignment
Affected: fixed in 0.3.8.
Fixed in 0.3.8 (released May 23, 2023, 12 days after disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2023-30837High 7.5
Vyper storage allocator overflow
Affected: fixed in 0.3.8.
Fixed in 0.3.8 (released May 23, 2023, 15 days after disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2023-30629High 7.5
Vyper's raw_call with outsize=0 and revert_on_failure=False returns incorrect success value
Affected: from 0.3.1, fixed in 0.3.8.
Fixed in 0.3.8 (released May 23, 2023, 29 days after disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2022-29255High 8.2
Multiple evaluation of contract address in call in vyper
Affected: fixed in 0.3.4.
Fixed in 0.3.4 (released Jul 27, 2022, 51 days after disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2022-24845High 8.8
Integer bounds error in Vyper
Affected: fixed in 0.3.2.
Fixed in 0.3.2 (released Apr 19, 2022, 6 days after disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2022-24788High 7.1
Buffer overflow in Vyper
Affected: fixed in 0.3.2.
Fixed in 0.3.2 (released Apr 19, 2022, 6 days after disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2022-24787High 7.5
Incorrect Comparison in Vyper
Affected: fixed in 0.3.2.
Fixed in 0.3.2 (released Apr 19, 2022, 15 days after disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2021-41121High 7.5
Memory corruption in Vyper
Affected: fixed in 0.3.0.
Fixed in 0.3.0 (released Oct 5, 2021, 1 day before disclosure).
The latest release, 0.4.3, is not affected.
- CVE-2021-41122Medium 4.3
Bounds check missing for decimal args in Vyper
Affected: fixed in 0.3.0.
Fixed in 0.3.0 (released Oct 5, 2021, the day of disclosure).
The latest release, 0.4.3, is not affected.