What’s Vulnerable › Vulnerabilities

CVE-2020-37288: Vyper 0.1.0b10 before 0.2.3 Invalid Jump Destination via Return in Nested Loops

• Severity: low (CVSS 3.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-21 · updated 2026-10-22
• Weakness: CWE-670

Description

Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination (stack underflow). Affected contracts revert such calls unnecessarily, which in limited circumstances could enable denial of service against public contracts.

Affected products

• Pypi Vyper: from 0.1.0b10 before 0.2.3; 0.1.0b10, 0.1.0b11, 0.1.0b12, 0.1.0b13, 0.1.0b14, 0.1.0b15 (+4) — fixed in 0.2.3
• vyperlang vyper: from 0.1.0b10 before 0.2.3 — fixed in 0.2.3

How to fix

Upgrade to a fixed version: Pypi Vyper 0.2.3; vyperlang vyper 0.2.3. Check the vendor advisory for mitigations.

References

• https://github.com/vyperlang/vyper/security/advisories/GHSA-vg88-3v92-rjx2
• https://www.vulncheck.com/advisories/vyper-0.1-0b10-before-0.2.3-invalid-jump-destination-via-return-in-nested-loops

Get alerted when CVE-2020-37288 or the next vulnerability affects your stack