vyperlang has 12 CVEs on record. Disclosure cadence is accelerating: 12 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 12. The median CVSS is 5.3 (medium). None have a confirmed exploitation report. The most common weakness class is CWE-787 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.3
- Publish → KEV
- —
- Last 90 days
- 12 prev 0
Worst active — by depth score
CVE-2021-48018High· 7.4Vyper 0.2.13 before 0.2.15 Storage Corruption via @nonreentrant Decorator41CVE-2021-48020Medium· 6.5Vyper before 0.3.0 Memory Corruption via Internal Function Calls in Arrays36CVE-2020-37286Medium· 6.5Vyper 0.1.0b4 before 0.3.0 Memory Corruption via Nested Internal Function Calls36CVE-2026-114117Medium· 5.9Vyper 0.3.8 through 0.5.0b1 Optimizer Miscompilation of msg.value | K in Ternary Branches32CVE-2020-37287Medium· 5.9Vyper before 0.2.6 Call Stack Corruption via Complex Type Function Arguments32
vyperlang vulnerabilities
CVEs affecting vyperlang, newest first. Open any entry for full detail, references, and exploit status.
12 CVEsRSS
CVE-2020-37288Low· 3.7Vyper 0.1.0b10 before 0.2.3 Invalid Jump Destination via Return in Nested Loops
Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination (stack underflow). Affected contract…
CVE-2020-37286Medium· 6.5Vyper 0.1.0b4 before 0.3.0 Memory Corruption via Nested Internal Function Calls
Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested calls. Contracts using such calls as tuple elements, call arg…
CVE-2020-37289Low· 3.7Vyper before 0.3.1 Improper Input Validation of uint8 Interface Return Values
Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decimals(), to be stored in uint256 variables without bounds checking. Malicious contracts can return values greater than 255 to man…
CVE-2020-37287Medium· 5.9Vyper before 0.2.6 Call Stack Corruption via Complex Type Function Arguments
Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passed as arguments. Contracts passing multi-dimensional arrays or structs to internal …
CVE-2021-48020Medium· 6.5Vyper before 0.3.0 Memory Corruption via Internal Function Calls in Arrays
Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are performed inside arrays. Contracts placing internal calls in nested array elements, exte…
CVE-2021-48019Medium· 4.8Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies
Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data whe…
CVE-2021-48018High· 7.4Vyper 0.2.13 before 0.2.15 Storage Corruption via @nonreentrant Decorator
Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variables. When a function using @nonreentrant is called, setting the lock overwrites the overlapping st…
CVE-2026-114114Medium· 5.3Vyper through 0.5.0b1 Literal Value Substitution via Multi-byte Characters
Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct la…
CVE-2026-114117Medium· 5.9Vyper 0.3.8 through 0.5.0b1 Optimizer Miscompilation of msg.value | K in Ternary Branches
Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas…
CVE-2026-114116Medium· 5.3Vyper through 0.5.0b1 Literal Value Manipulation via Line Separators
Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified an…
CVE-2026-114115Low· 3.7Vyper 0.3.8 through 0.5.0b1 Memory Misread via Ternary Nested Array Selection
Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that reads nested arrays with narrower inner bounds using the wider result type's memory layout. When a ternary selects the narrower array, inner…
CVE-2026-114118Medium· 4.8Vyper 0.3.4 through 0.5.0b1 create_from_blueprint Offset Validation Bypass via Unsigned Wraparound
Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by uint256 subtraction without first checking that code_offset is below the blueprint's code size, so a huge offset wraps to a small positive valu…