# vyper (PyPI) vulnerabilities 47 known vulnerabilities (3 critical, 17 high, 14 medium, 13 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 0.4.3 (Jun 18, 2025): affected by 2 advisories - Newest unaffected release: Every release is affected by at least one advisory - Weekly downloads: 30.6K - Dependents: 36 - Releases: 79 since 0.2.1 (Jul 3, 2020) - Registry: https://pypi.org/project/vyper/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2021-48020: 0.1.0b1 to 0.2.11 (0.2.12 is outside it) - CVE-2021-48019: 0.1.0b1 to 0.2.8 (0.2.9 is outside it) - CVE-2021-48018: 0.2.13 to 0.2.14 (0.2.15 is outside it) - CVE-2020-37289: 0.1.0b1 to 0.1.0b16 (0.1.0b17 is outside it) - CVE-2020-37288: 0.1.0b10 to 0.2.2 (0.2.3 is outside it) - CVE-2020-37287: 0.1.0b1 to 0.2.5 (0.2.6 is outside it) - CVE-2020-37286: 0.1.0b1 to 0.2.5 (0.2.6 is outside it) - CVE-2025-47774: 0.1.0b1 to 0.4.2rc1 (0.4.2 is outside it) - CVE-2025-47285: 0.1.0b1 to 0.4.2rc1 (0.4.2 is outside it) - CVE-2025-26622: 0.1.0b1 to 0.4.1rc3 (0.4.1 is outside it) - CVE-2025-27104: 0.1.0b1 to 0.4.1rc3 (0.4.1 is outside it) - CVE-2025-27105: 0.1.0b1 to 0.4.1rc3 (0.4.1 is outside it) - CVE-2025-21607: 0.1.0b1 to 0.5.0b2 (through the newest release) - CVE-2024-32649: 0.1.0b1 to 0.4.0rc6 (0.4.0 is outside it) - CVE-2024-32648: 0.1.0b1 to 0.2.16 (0.3.0 is outside it) - CVE-2024-32647: 0.1.0b1 to 0.4.0rc6 (0.4.0 is outside it) - CVE-2024-32646: 0.1.0b1 to 0.4.0rc6 (0.4.0 is outside it) - CVE-2024-32645: 0.1.0b1 to 0.4.0rc6 (0.4.0 is outside it) - CVE-2024-32481: 0.3.8 to 0.4.0rc6 (0.4.0 is outside it) - CVE-2024-24564: its ranges can't be placed on these versions - CVE-2024-26149: 0.1.0b1 to 0.4.0rc6 (0.4.0 is outside it) - CVE-2024-24563: 0.1.0b1 to 0.4.0rc6 (0.4.0 is outside it) - CVE-2024-24559: 0.1.0b1 to 0.4.0rc6 (0.4.0 is outside it) - CVE-2024-24560: 0.1.0b1 to 0.4.0rc6 (0.4.0 is outside it) - CVE-2024-24561: 0.1.0b1 to 0.4.0rc6 (0.4.0 is outside it) - CVE-2024-24567: 0.1.0b1 to 0.4.0rc6 (0.4.0 is outside it) - CVE-2024-22419: 0.1.0b1 to 0.4.0rc6 (0.4.0 is outside it) - CVE-2023-46247: 0.1.0b1 to 0.3.7 (0.3.8 is outside it) - CVE-2023-42460: 0.3.4 to 0.3.10rc5 (0.3.10 is outside it) - CVE-2023-42443: 0.1.0b1 to 0.3.10rc5 (0.3.10 is outside it) - CVE-2023-42441: 0.2.9 to 0.3.10rc5 (0.3.10 is outside it) - CVE-2023-40015: 0.1.0b1 to 0.4.2 (0.4.3rc1 is outside it) - CVE-2023-41052: 0.1.0b1 to 0.3.10rc5 (0.3.10 is outside it) - CVE-2023-39363: 0.1.0b1 to 0.5.0b2 (through the newest release) - CVE-2023-37902: 0.1.0b1 to 0.3.10rc5 (0.3.10 is outside it) - CVE-2023-32675: 0.1.0b1 to 0.3.7 (0.3.8 is outside it) - CVE-2023-32059: 0.1.0b1 to 0.3.7 (0.3.8 is outside it) - CVE-2023-32058: 0.1.0b1 to 0.3.7 (0.3.8 is outside it) - CVE-2023-31146: 0.1.0b1 to 0.3.7 (0.3.8 is outside it) - CVE-2023-30837: 0.1.0b1 to 0.3.7 (0.3.8 is outside it) - CVE-2023-30629: 0.3.1 to 0.3.7 (0.3.8 is outside it) - CVE-2022-29255: 0.1.0b1 to 0.3.3 (0.3.4 is outside it) - CVE-2022-24845: 0.1.0b1 to 0.3.1 (0.3.2 is outside it) - CVE-2022-24788: 0.1.0b1 to 0.3.1 (0.3.2 is outside it) - CVE-2022-24787: 0.1.0b1 to 0.3.1 (0.3.2 is outside it) - CVE-2021-41121: 0.1.0b1 to 0.2.16 (0.3.0 is outside it) - CVE-2021-41122: 0.1.0b1 to 0.2.16 (0.3.0 is outside it) ## Advisories (47) ### [CVE-2021-48020](https://cve.now/CVE-2021-48020): Vyper before 0.3.0 Memory Corruption via Internal Function Calls in Arrays - Severity: High 8.3 - Published: Oct 21, 2026 - Affected: fixed in 0.2.12. - Fixed in 0.2.12 (released Apr 16, 2021, 2014 days before disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2021-48019](https://cve.now/CVE-2021-48019): Vyper before 0.2.9 Incorrect RETURNDATASIZE in create\_forwarder\_to Proxies - Severity: Medium 6.3 - Published: Oct 21, 2026 - Affected: fixed in 0.2.9. - Fixed in 0.2.9 (released Feb 17, 2021, 2072 days before disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2021-48018](https://cve.now/CVE-2021-48018): Vyper 0.2.13 before 0.2.15 Storage Corruption via @nonreentrant Decorator - Severity: High 8.3 - Published: Oct 21, 2026 - Affected: from 0.2.13, fixed in 0.2.15. - Fixed in 0.2.15 (released Jul 24, 2021, 1915 days before disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2020-37289](https://cve.now/CVE-2020-37289): Vyper before 0.3.1 Improper Input Validation of uint8 Interface Return Values - Severity: Medium 6.3 - Published: Oct 21, 2026 - Affected: through 0.1.0b16. - Fixed in 0.2.1 (released Jul 3, 2020, 2301 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 0.4.3, is not affected. ### [CVE-2020-37288](https://cve.now/CVE-2020-37288): Vyper 0.1.0b10 before 0.2.3 Invalid Jump Destination via Return in Nested Loops - Severity: Medium 6.3 - Published: Oct 21, 2026 - Affected: from 0.1.0b10, fixed in 0.2.3. - Fixed in 0.2.3 (released Jul 16, 2020, 2288 days before disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2020-37287](https://cve.now/CVE-2020-37287): Vyper before 0.2.6 Call Stack Corruption via Complex Type Function Arguments - Severity: High 8.2 - Published: Oct 21, 2026 - Affected: fixed in 0.2.6. - Fixed in 0.2.6 (released Oct 10, 2020, 2202 days before disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2020-37286](https://cve.now/CVE-2020-37286): Vyper 0.1.0b4 before 0.3.0 Memory Corruption via Nested Internal Function Calls - Severity: High 8.3 - Published: Oct 21, 2026 - Affected: fixed in 0.2.6. - Fixed in 0.2.6 (released Oct 10, 2020, 2202 days before disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2025-47774](https://cve.now/CVE-2025-47774): Vyper's \`slice()\` may elide side-effects when output length is 0 - Severity: Low 2.9 - Published: May 15, 2025 - Affected: through 0.4.2rc1. - Fixed in 0.4.2 (released May 31, 2025, 16 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 0.4.3, is not affected. ### [CVE-2025-47285](https://cve.now/CVE-2025-47285): Vyper's \`concat()\` builtin may elide side-effects for zero-length arguments - Severity: Low 2.9 - Published: May 15, 2025 - Affected: through 0.4.2rc1. - Fixed in 0.4.2 (released May 31, 2025, 16 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 0.4.3, is not affected. ### [CVE-2025-26622](https://cve.now/CVE-2025-26622): sqrt doesn't define rounding behavior in Vyper - Severity: Low 2.3 - Published: Feb 21, 2025 - Affected: fixed in 0.4.1. - Fixed in 0.4.1 (released Mar 1, 2025, 8 days after disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2025-27104](https://cve.now/CVE-2025-27104): double eval in For List Iter in Vyper - Severity: Low 2.3 - Published: Feb 21, 2025 - Affected: fixed in 0.4.1. - Fixed in 0.4.1 (released Mar 1, 2025, 8 days after disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2025-27105](https://cve.now/CVE-2025-27105): AugAssign evaluation order causing OOB write within the object in Vyper - Severity: Low 2.3 - Published: Feb 21, 2025 - Affected: fixed in 0.4.1. - Fixed in 0.4.1 (released Mar 1, 2025, 8 days after disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2025-21607](https://cve.now/CVE-2025-21607): Success of Certain Precompile Calls not Checked in Vyper - Severity: Low 2.3 - Published: Jan 14, 2025 - Affected: all versions; fixed in 0.4.1. - No fix released. The latest release, 0.4.3, is still affected. ### [CVE-2024-32649](https://cve.now/CVE-2024-32649): vyper performs double eval of the argument of sqrt - Severity: Medium 5.3 - Published: Apr 25, 2024 - Affected: fixed in 0.4.0. - Fixed in 0.4.0 (released Jun 20, 2024, 56 days after disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2024-32648](https://cve.now/CVE-2024-32648): vyper default functions don't respect nonreentrancy keys - Severity: Medium 5.3 - Published: Apr 25, 2024 - Affected: fixed in 0.3.0; fixed in 0.3.0. - Fixed in 0.3.0 (released Oct 5, 2021, 933 days before disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2024-32647](https://cve.now/CVE-2024-32647): vyper performs double eval of raw\_args in create\_from\_blueprint - Severity: Medium 5.3 - Published: Apr 25, 2024 - Affected: fixed in 0.4.0. - Fixed in 0.4.0 (released Jun 20, 2024, 56 days after disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2024-32646](https://cve.now/CVE-2024-32646): vyper performs double eval of the slice args when buffer from adhoc locations - Severity: Medium 5.3 - Published: Apr 25, 2024 - Affected: fixed in 0.4.0. - Fixed in 0.4.0 (released Jun 20, 2024, 56 days after disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2024-32645](https://cve.now/CVE-2024-32645): vyper performs incorrect topic logging in raw\_log - Severity: Medium 5.3 - Published: Apr 25, 2024 - Affected: fixed in 0.4.0. - Fixed in 0.4.0 (released Jun 20, 2024, 56 days after disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2024-32481](https://cve.now/CVE-2024-32481): vyper's range(start, start + N) reverts for negative numbers - Severity: Medium 5.3 - Published: Apr 25, 2024 - Affected: from 0.3.8, fixed in 0.4.0; from 0.3.8, fixed in 0.4.0b1. - Fixed in 0.4.0 (released Jun 20, 2024, 56 days after disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2024-24564](https://cve.now/CVE-2024-24564): Vyper extract32 can ready dirty memory - Severity: Low 3.7 - Published: Feb 26, 2024 - Affected: fixed in 0.4.0; fixed in 0.4.0. ### [CVE-2024-26149](https://cve.now/CVE-2024-26149): Vyper \_abi\_decode Memory Overflow - Severity: Low 3.7 - Published: Feb 26, 2024 - Affected: fixed in 0.4.0; fixed in 0.4.0b1. - Fixed in 0.4.0 (released Jun 20, 2024, 115 days after disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2024-24563](https://cve.now/CVE-2024-24563): Vyper array negative index vulnerability - Severity: Critical 9.8 - Published: Feb 7, 2024 - Affected: fixed in 0.4.0b1; fixed in 0.4.0. - Fixed in 0.4.0 (released Jun 20, 2024, 134 days after disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2024-24559](https://cve.now/CVE-2024-24559): Vyper SHA3 code generation bug - Severity: Low 3.7 - Published: Feb 5, 2024 - Affected: fixed in 0.4.0b1; fixed in 0.4.0. - Fixed in 0.4.0 (released Jun 20, 2024, 136 days after disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2024-24560](https://cve.now/CVE-2024-24560): Vyper external calls can overflow return data to return input buffer - Severity: Low 3.7 - Published: Feb 2, 2024 - Affected: fixed in 0.4.0b1; fixed in 0.4.0. - Fixed in 0.4.0 (released Jun 20, 2024, 139 days after disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2024-24561](https://cve.now/CVE-2024-24561): Vyper bounds check on built-in \`slice()\` function can be overflowed - Severity: Critical 9.8 - Published: Feb 1, 2024 - Affected: fixed in 0.4.0; fixed in 0.4.0b1. - Fixed in 0.4.0 (released Jun 20, 2024, 140 days after disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2024-24567](https://cve.now/CVE-2024-24567): raw\_call \`value=\` kwargs not disabled for static and delegate calls - Severity: Medium 4.8 - Published: Jan 30, 2024 - Affected: fixed in 0.4.0b1; fixed in 0.4.0. - Fixed in 0.4.0 (released Jun 20, 2024, 142 days after disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2024-22419](https://cve.now/CVE-2024-22419): concat built-in can corrupt memory in vyper - Severity: High 7.3 - Published: Jan 18, 2024 - Affected: from 0.3.0, fixed in 0.4.0; fixed in 0.4.0b1. - Fixed in 0.4.0 (released Jun 20, 2024, 154 days after disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2023-46247](https://cve.now/CVE-2023-46247): Vyper has incorrect storage layout for contracts containing large arrays - Severity: High 7.5 - Published: Dec 13, 2023 - Affected: fixed in 0.3.8. - Fixed in 0.3.8 (released May 23, 2023, 204 days before disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2023-42460](https://cve.now/CVE-2023-42460): \_abi\_decode input not validated in complex expressions in Vyper - Severity: Medium 5.3 - Published: Sep 26, 2023 - Affected: from 0.3.4, fixed in 0.3.10. - Fixed in 0.3.10 (released Oct 4, 2023, 8 days after disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2023-42443](https://cve.now/CVE-2023-42443): Vyper vulnerable to memory corruption in certain builtins utilizing \`msize\` - Severity: High 8.1 - Published: Sep 18, 2023 - Affected: fixed in 0.3.10; from 0.3.4, fixed in 0.3.10. - Fixed in 0.3.10 (released Oct 4, 2023, 16 days after disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2023-42441](https://cve.now/CVE-2023-42441): Vyper has incorrect re-entrancy lock when key is empty string - Severity: Medium 5.3 - Published: Sep 18, 2023 - Affected: from 0.2.9, fixed in 0.3.10. - Fixed in 0.3.10 (released Oct 4, 2023, 16 days after disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2023-40015](https://cve.now/CVE-2023-40015): Vyper: reversed order of side effects for some operations - Severity: Low 3.7 - Published: Sep 4, 2023 - Affected: fixed in 0.3.10rc1; through 0.4.2. - Fixed in 0.4.3 (released Jun 18, 2025, 653 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 0.4.3, is not affected. ### [CVE-2023-41052](https://cve.now/CVE-2023-41052): Vyper: incorrect order of evaluation of side effects for some builtins - Severity: Low 3.7 - Published: Sep 4, 2023 - Affected: fixed in 0.3.10; fixed in 0.3.10rc1. - Fixed in 0.3.10 (released Oct 4, 2023, 30 days after disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2023-39363](https://cve.now/CVE-2023-39363): Vyper incorrectly allocated named re-entrancy locks - Severity: Critical 9.1 - Published: Aug 7, 2023 - Affected: all versions; from 0.2.15, fixed in 0.3.1. - No fix released. The latest release, 0.4.3, is still affected. ### [CVE-2023-37902](https://cve.now/CVE-2023-37902): Vyper's ecrecover can return undefined data if signature does not verify - Severity: Medium 5.3 - Published: Jul 25, 2023 - Affected: fixed in 0.3.10; fixed in 0.3.9. - Fixed in 0.3.10 (released Oct 4, 2023, 71 days after disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2023-32675](https://cve.now/CVE-2023-32675): Nonpayable default functions are sometimes payable in vyper - Severity: Low 3.7 - Published: May 19, 2023 - Affected: fixed in 0.3.8. - Fixed in 0.3.8 (released May 23, 2023, 4 days after disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2023-32059](https://cve.now/CVE-2023-32059): Vyper vulnerable to incorrect ordering of arguments for kwargs passed to internal calls - Severity: High 7.5 - Published: May 11, 2023 - Affected: fixed in 0.3.8. - Fixed in 0.3.8 (released May 23, 2023, 12 days after disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2023-32058](https://cve.now/CVE-2023-32058): Vyper vulnerable to integer overflow in loop - Severity: High 7.5 - Published: May 11, 2023 - Affected: fixed in 0.3.8. - Fixed in 0.3.8 (released May 23, 2023, 12 days after disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2023-31146](https://cve.now/CVE-2023-31146): Vyper vulnerable to OOB DynArray access when array is on both LHS and RHS of an assignment - Severity: High 7.5 - Published: May 11, 2023 - Affected: fixed in 0.3.8. - Fixed in 0.3.8 (released May 23, 2023, 12 days after disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2023-30837](https://cve.now/CVE-2023-30837): Vyper storage allocator overflow - Severity: High 7.5 - Published: May 8, 2023 - Affected: fixed in 0.3.8. - Fixed in 0.3.8 (released May 23, 2023, 15 days after disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2023-30629](https://cve.now/CVE-2023-30629): Vyper's raw\_call with outsize=0 and revert\_on\_failure=False returns incorrect success value - Severity: High 7.5 - Published: Apr 24, 2023 - Affected: from 0.3.1, fixed in 0.3.8. - Fixed in 0.3.8 (released May 23, 2023, 29 days after disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2022-29255](https://cve.now/CVE-2022-29255): Multiple evaluation of contract address in call in vyper - Severity: High 8.2 - Published: Jun 6, 2022 - Affected: fixed in 0.3.4. - Fixed in 0.3.4 (released Jul 27, 2022, 51 days after disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2022-24845](https://cve.now/CVE-2022-24845): Integer bounds error in Vyper - Severity: High 8.8 - Published: Apr 13, 2022 - Affected: fixed in 0.3.2. - Fixed in 0.3.2 (released Apr 19, 2022, 6 days after disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2022-24788](https://cve.now/CVE-2022-24788): Buffer overflow in Vyper - Severity: High 7.1 - Published: Apr 13, 2022 - Affected: fixed in 0.3.2. - Fixed in 0.3.2 (released Apr 19, 2022, 6 days after disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2022-24787](https://cve.now/CVE-2022-24787): Incorrect Comparison in Vyper - Severity: High 7.5 - Published: Apr 4, 2022 - Affected: fixed in 0.3.2. - Fixed in 0.3.2 (released Apr 19, 2022, 15 days after disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2021-41121](https://cve.now/CVE-2021-41121): Memory corruption in Vyper - Severity: High 7.5 - Published: Oct 6, 2021 - Affected: fixed in 0.3.0. - Fixed in 0.3.0 (released Oct 5, 2021, 1 day before disclosure). - The latest release, 0.4.3, is not affected. ### [CVE-2021-41122](https://cve.now/CVE-2021-41122): Bounds check missing for decimal args in Vyper - Severity: Medium 4.3 - Published: Oct 5, 2021 - Affected: fixed in 0.3.0. - Fixed in 0.3.0 (released Oct 5, 2021, the day of disclosure). - The latest release, 0.4.3, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/vyper Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.