vyper has 20 CVEs on record between 2021 and 2025. The median CVSS is 7.5 (high), with 2 rated critical. None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 0 prev 0
Weakness classes
Products
- vyper 20
Worst active — by depth score
CVE-2024-24563Critical· 9.8Vyper negative array index bounds checks54CVE-2024-24561Critical· 9.8Vyper's bounds check on built-in `slice()` function can be overflowed54CVE-2023-39363High· 8.7Vyper has incorrectly allocated named re-entrancy locks48CVE-2023-46247High· 7.5incorrect storage layout for contracts containing large arrays41CVE-2023-32059High· 7.5Vyper vulnerable to incorrect ordering of arguments for kwargs passed to internal calls41
vyper vulnerabilities
CVEs affecting vyper, newest first. Open any entry for full detail, references, and exploit status.
20 CVEsRSS
CVE-2025-47285LowVyper's `concat()` builtin may elide side-effects for zero-length arguments
Vyper's `concat()` builtin may elide side-effects for zero-length arguments
CVE-2025-47774LowVyper's `slice()` may elide side-effects when output length is 0
Vyper's `slice()` may elide side-effects when output length is 0
CVE-2025-21607LowVyper Does Not Check the Success of Certain Precompile Calls
Vyper Does Not Check the Success of Certain Precompile Calls
CVE-2024-24563Critical· 9.8Vyper negative array index bounds checks
Vyper negative array index bounds checks
CVE-2024-24559Low· 3.7Vyper sha3 codegen bug
Vyper sha3 codegen bug
CVE-2024-24560Low· 3.7Vyper's external calls can overflow return data to return input buffer
Vyper's external calls can overflow return data to return input buffer
CVE-2024-24561Critical· 9.8Vyper's bounds check on built-in `slice()` function can be overflowed
Vyper's bounds check on built-in `slice()` function can be overflowed
CVE-2024-24567Medium· 4.8Vyper's raw_call `value=` kwargs not disabled for static and delegate calls
Vyper's raw_call `value=` kwargs not disabled for static and delegate calls
CVE-2024-22419High· 7.3concat built-in can corrupt memory in vyper
concat built-in can corrupt memory in vyper
CVE-2023-46247High· 7.5incorrect storage layout for contracts containing large arrays
incorrect storage layout for contracts containing large arrays
CVE-2023-42441Medium· 5.3Vyper has incorrect re-entrancy lock when key is empty string
Vyper has incorrect re-entrancy lock when key is empty string
CVE-2023-41052Medium· 5.3incorrect order of evaluation of side effects for some builtins
incorrect order of evaluation of side effects for some builtins
CVE-2023-39363High· 8.7Vyper has incorrectly allocated named re-entrancy locks
Vyper has incorrectly allocated named re-entrancy locks
CVE-2023-32059High· 7.5Vyper vulnerable to incorrect ordering of arguments for kwargs passed to internal calls
Vyper vulnerable to incorrect ordering of arguments for kwargs passed to internal calls
CVE-2023-32058High· 7.5Vyper vulnerable to integer overflow in loop
Vyper vulnerable to integer overflow in loop
CVE-2023-31146High· 7.5Vyper vulnerable to OOB DynArray access when array is on both LHS and RHS of an assignment
Vyper vulnerable to OOB DynArray access when array is on both LHS and RHS of an assignment
CVE-2023-30837High· 7.5vyper vulnerable to storage allocator overflow
vyper vulnerable to storage allocator overflow
CVE-2023-30629High· 7.5Incorrect success value returned in vyper
Incorrect success value returned in vyper
CVE-2021-41121High· 7.5Memory corruption when returning a literal struct with a private call inside of it
Memory corruption when returning a literal struct with a private call inside of it
CVE-2021-41122Medium· 4.3missing clamps for decimal args in external functions
missing clamps for decimal args in external functions