What’s Vulnerable › Vulnerabilities

CVE-2023-30837: Vyper storage allocator overflow

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-05-08 · updated 2026-06-17
• Weakness: CWE-789

Description

Vyper is a pythonic smart contract language for the EVM. The storage allocator does not guard against allocation overflows in versions prior to 0.3.8. An attacker can overwrite the owner variable. This issue was fixed in version 0.3.8.

Affected products

• vyperlang vyper: before 0.3.8 — fixed in 0.3.8

How to fix

Upgrade to a fixed version: vyperlang vyper 0.3.8. Check the vendor advisory for mitigations.

References

• https://github.com/vyperlang/vyper/commit/0bb7203b584e771b23536ba065a6efda457161bb
• https://github.com/vyperlang/vyper/security/advisories/GHSA-mgv8-gggw-mrg6
• https://github.com/vyperlang/vyper/commit/0bb7203b584e771b23536ba065a6efda457161bb
• https://github.com/vyperlang/vyper/security/advisories/GHSA-mgv8-gggw-mrg6

Get alerted when CVE-2023-30837 or the next vulnerability affects your stack