{"id":"CVE-2021-48019","title":"Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies","summary":"Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data whe…","severity":"medium","cvss":4.8,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","cvssSource":"cna","cwe":["CWE-805"],"vendor":"vyperlang","product":"vyper","affected":["vyper < 0.2.9"],"published":"2026-10-21","updated":"2026-10-21","sourceUpdated":"2026-10-21T00:36:18.960Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2021-48019","references":[{"url":"https://github.com/vyperlang/vyper/security/advisories/GHSA-375m-5fvv-xq23","label":"GitHub Security Advisory (GHSA-375m-5fvv-xq23)"},{"url":"https://www.vulncheck.com/advisories/vyper-before-0.2.9-incorrect-returndatasize-in-create-forwarder-to-proxies","label":"VulnCheck Advisory: Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies"}],"tags":["cve.org"],"ingestedAt":"2026-10-21T01:37:08.048Z","slug":"CVE-2021-48019","body":"## Overview\n\nVyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data when a function returns more than 4096 bytes without return data sanitation, and fail strict return-size checks such as SafeERC20.safeTransfer.\n\n## Affected\n\n- `vyper < 0.2.9`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":26.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}