Vyperlang vulnerabilities
53 CVEs and advisories name Vyperlang as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-114663Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments
- CVE-2026-114118Vyper 0.3.4 through 0.5.0b1 create_from_blueprint Offset Validation Bypass via Unsigned Wraparound
- CVE-2026-114117Vyper 0.3.8 through 0.5.0b1 Optimizer Miscompilation of msg.value | K in Ternary Branches
- CVE-2026-114116Vyper through 0.5.0b1 Literal Value Manipulation via Line Separators
- CVE-2026-114115Vyper 0.3.8 through 0.5.0b1 Memory Misread via Ternary Nested Array Selection
- CVE-2026-114114Vyper through 0.5.0b1 Literal Value Substitution via Multi-byte Characters
- CVE-2021-48020Vyper before 0.3.0 Memory Corruption via Internal Function Calls in Arrays
- CVE-2021-48019Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies
- CVE-2021-48018Vyper 0.2.13 before 0.2.15 Storage Corruption via @nonreentrant Decorator
- CVE-2020-37289Vyper before 0.3.1 Improper Input Validation of uint8 Interface Return Values
- CVE-2020-37288Vyper 0.1.0b10 before 0.2.3 Invalid Jump Destination via Return in Nested Loops
- CVE-2020-37287Vyper before 0.2.6 Call Stack Corruption via Complex Type Function Arguments
- CVE-2020-37286Vyper 0.1.0b4 before 0.3.0 Memory Corruption via Nested Internal Function Calls
- CVE-2025-47774Vyper's `slice()` may elide side-effects when output length is 0
- CVE-2025-47285Vyper's `concat()` builtin may elide side-effects for zero-length arguments
- CVE-2025-26622sqrt doesn't define rounding behavior in Vyper
- CVE-2025-27104double eval in For List Iter in Vyper
- CVE-2025-27105AugAssign evaluation order causing OOB write within the object in Vyper
- CVE-2025-21607Success of Certain Precompile Calls not Checked in Vyper
- CVE-2024-32649vyper performs double eval of the argument of sqrt
- CVE-2024-32648vyper default functions don't respect nonreentrancy keys
- CVE-2024-32647vyper performs double eval of raw_args in create_from_blueprint
- CVE-2024-32646vyper performs double eval of the slice args when buffer from adhoc locations
- CVE-2024-32645vyper performs incorrect topic logging in raw_log
- CVE-2024-32481vyper's range(start, start + N) reverts for negative numbers
- CVE-2024-24564Vyper extract32 can ready dirty memory
- CVE-2024-26149Vyper _abi_decode Memory Overflow
- CVE-2024-24563Vyper array negative index vulnerability
- CVE-2024-24559Vyper SHA3 code generation bug
- CVE-2024-24560Vyper external calls can overflow return data to return input buffer