What’s Vulnerable › Vulnerabilities

CVE-2020-37286: Vyper 0.1.0b4 before 0.3.0 Memory Corruption via Nested Internal Function Calls

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-21 · updated 2026-10-27
• Weakness: CWE-787

Description

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested calls. Contracts using such calls as tuple elements, call arguments, or builtin arguments like concat or ecrecover can return corrupted values or pass wrong arguments to external calls.

Affected products

• Pypi Vyper: before 0.2.6; 0.1.0b1, 0.1.0b10, 0.1.0b11, 0.1.0b12, 0.1.0b13, 0.1.0b14 (+16) — fixed in 0.2.6
• vyperlang vyper: from 0.1.0b4 before 0.3.0 — fixed in 0.3.0

How to fix

Upgrade to a fixed version: Pypi Vyper 0.2.6; vyperlang vyper 0.3.0. Check the vendor advisory for mitigations.

References

• https://github.com/vyperlang/vyper/security/advisories/GHSA-2r3x-4mrv-mcxf
• https://www.vulncheck.com/advisories/vyper-0.1-0b4-before-0.3.0-memory-corruption-via-nested-internal-function-calls

Get alerted when CVE-2020-37286 or the next vulnerability affects your stack