Vyperlang
Vyperlang Vyper: vulnerabilidades y CVE
Vyperlang Vyper tiene 40 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 7 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE40
Últimos 12 meses0
Críticas7
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2025-47774 | Baja (2.9) | 0.46% | — | 15 may 2025 | Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, the `slice()` builtin can elide side effects when the output length is 0, and the source bytestring… |
| CVE-2025-47285 | Baja (2.9) | 0.45% | — | 15 may 2025 | Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, `concat()` may skip evaluation of side effects when the length of an argument is zero. This is due… |
| CVE-2025-27105 | Baja (2.3) | 0.57% | — | 21 feb 2025 | vyper is a Pythonic Smart Contract Language for the EVM. Vyper handles AugAssign statements by first caching the target location to avoid double evaluation. However, in the case when target is an access to a DynArray… |
| CVE-2025-27104 | Baja (2.3) | 0.45% | — | 21 feb 2025 | vyper is a Pythonic Smart Contract Language for the EVM. Multiple evaluation of a single expression is possible in the iterator target of a for loop. While the iterator expression cannot produce multiple writes, it can… |
| CVE-2025-26622 | Baja (2.3) | 0.33% | — | 21 feb 2025 | vyper is a Pythonic Smart Contract Language for the EVM. Vyper `sqrt()` builtin uses the babylonian method to calculate square roots of decimals. Unfortunately, improper handling of the oscillating final states may lead… |
| CVE-2025-21607 | Baja (2.3) | 0.65% | — | 14 ene 2025 | Vyper is a Pythonic Smart Contract Language for the EVM. When the Vyper Compiler uses the precompiles EcRecover (0x1) and Identity (0x4), the success flag of the call is not checked. As a consequence an attacker can… |
| CVE-2024-32649 | Media (5.3) | 0.46% | — | 25 abr 2024 | Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `sqrt` builtin can result in double eval vulnerability when the argument has side-effects. It can be… |
| CVE-2024-32648 | Media (5.3) | 0.41% | — | 25 abr 2024 | Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Prior to version 0.3.0, default functions don't respect nonreentrancy keys and the lock isn't emitted. No vulnerable production contracts… |
| CVE-2024-32647 | Media (5.3) | 0.46% | — | 25 abr 2024 | Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `create_from_blueprint` builtin can result in a double eval vulnerability when `raw_args=True` and… |
| CVE-2024-32646 | Media (5.3) | 0.46% | — | 25 abr 2024 | Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `slice` builtin can result in a double eval vulnerability when the buffer argument is either… |
| CVE-2024-32645 | Media (5.3) | 0.46% | — | 25 abr 2024 | Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, incorrect values can be logged when `raw_log` builtin is called with memory or storage arguments to be used as… |
| CVE-2024-32481 | Media (5.3) | 0.80% | — | 25 abr 2024 | Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Starting in version 0.3.8 and prior to version 0.4.0b1, when looping over a `range` of the form `range(start, start + N)`, if `start` is… |
| CVE-2024-26149 | Media (5.3) | 0.55% | — | 26 feb 2024 | Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. If an excessively large value is specified as the starting index for an array in `_abi_decode`, it can cause the read position to overflow.… |
| CVE-2024-24564 | Media (5.3) | 0.56% | — | 26 feb 2024 | Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. When using the built-in `extract32(b, start)`, if the `start` index provided has for side effect to update `b`, the byte array to extract… |
| CVE-2024-24563 | Crítica (9.8) | 1.5% | — | 7 feb 2024 | Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. Arrays can be keyed by a signed integer, while they are defined for unsigned integers only. The typechecker doesn't throw when spotting the… |
| CVE-2024-24559 | Media (5.3) | 0.26% | — | 5 feb 2024 | Vyper is a Pythonic Smart Contract Language for the EVM. There is an error in the stack management when compiling the `IR` for `sha3_64`. Concretely, the `height` variable is miscalculated. The vulnerability can't be… |
| CVE-2024-24560 | Media (5.3) | 0.53% | — | 2 feb 2024 | Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. When calls to external contracts are made, we write the input buffer starting at byte 28, and allocate the return buffer to start at byte 0… |
| CVE-2024-24561 | Crítica (9.8) | 0.90% | — | 1 feb 2024 | Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.10 and earlier, the bounds check for slices does not account for the ability for start + length to overflow when the values… |
| CVE-2024-24567 | Media (5.3) | 0.48% | — | 30 ene 2024 | Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Vyper compiler allows passing a value in builtin raw_call even if the call is a delegatecall or a staticcall. But in the context of… |
| CVE-2024-22419 | Crítica (9.8) | 0.77% | — | 18 ene 2024 | Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. The `concat` built-in can write over the bounds of the memory buffer that was allocated for it and thus overwrite existing valid data. The… |
| CVE-2023-46247 | Alta (7.5) | 0.70% | — | 13 dic 2023 | Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Contracts containing large arrays might underallocate the number of slots they need by 1. Prior to v0.3.8, the calculation to determine… |
| CVE-2023-42460 | Alta (7.5) | 0.67% | — | 27 sept 2023 | Vyper is a Pythonic Smart Contract Language for the EVM. The `_abi_decode()` function does not validate input when it is nested in an expression. Uses of `_abi_decode()` can be constructed which allow for bounds… |
| CVE-2023-42443 | Alta (8.1) | 0.83% | — | 18 sept 2023 | Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In version 0.3.9 and prior, under certain conditions, the memory used by the builtins `raw_call`, `create_from_blueprint` and… |
| CVE-2023-42441 | Media (5.3) | 0.51% | — | 18 sept 2023 | Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Starting in version 0.2.9 and prior to version 0.3.10, locks of the type `@nonreentrant("")` or `@nonreentrant('')` do not produce… |
| CVE-2023-41052 | Media (5.3) | 0.54% | — | 4 sept 2023 | Vyper is a Pythonic Smart Contract Language. In affected versions the order of evaluation of the arguments of the builtin functions `uint256_addmod`, `uint256_mulmod`, `ecadd` and `ecmul` does not follow source order.… |
| CVE-2023-40015 | Media (5.3) | 0.49% | — | 4 sept 2023 | Vyper is a Pythonic Smart Contract Language. For the following (probably non-exhaustive) list of expressions, the compiler evaluates the arguments from right to left instead of left to right. `unsafe_add, unsafe_sub,… |
| CVE-2023-39363 | Crítica (9.1) | 0.82% | — | 7 ago 2023 | Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock… |
| CVE-2023-37902 | Media (5.3) | 0.57% | — | 25 jul 2023 | Vyper is a Pythonic programming language that targets the Ethereum Virtual Machine (EVM). Prior to version 0.3.10, the ecrecover precompile does not fill the output buffer if the signature does not verify. However, the… |
| CVE-2023-32675 | Media (5.3) | 0.55% | — | 19 may 2023 | Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In contracts with more than one regular nonpayable function, it is possible to send funds to the default function, even if the default… |
| CVE-2023-32059 | Alta (7.5) | 0.73% | — | 11 may 2023 | Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, internal calls with default arguments are compiled incorrectly. Depending on the number of arguments provided in the… |