CVE-2022-24788: Buffer Overflow in vyper
Summary
CVE-2022-24788: Buffer Overflow in vyper. Affects vyper versions < 0.3.2. Fixed in 0.3.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vyper is a Python-based programming language specifically designed for writing smart contracts on the Ethereum blockchain. It offers a simplified syntax and aims to enhance security by eliminating common pitfalls in Solidity, the predominant language for Ethereum smart contracts. However, a vulnerability has been discovered in Vyper that can lead to a buffer overflow when importing a function from a JSON interface that returns bytes. This vulnerability can potentially result in a buffer overrun, compromising the integrity and stability of the affected system.
Vulnerability Detail
The vulnerability arises from the generation of bytecode that does not clamp the length of returned bytes. As a result, an attacker could exploit this oversight to overflow the buffer, potentially leading to arbitrary code execution or denial of service attacks. The impact of this vulnerability is classified as HIGH, with a CVSS score of 7.1. The vulnerability is identified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input).
How To Fix
Latest published version: 0.4.3 as of 22 Oct 2026
pip install --upgrade "vyper==0.4.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.3.2
This is the first release that contains the fix.
pip install --upgrade "vyper==0.3.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the Vyper package is not immediately feasible, a workaround is to use .vy interfaces instead of importing functions from a JSON interface that returns bytes. By utilizing .vy interfaces, the bytecode generation will properly handle the length of returned bytes, mitigating the risk of buffer overflows.
Conclusion
In conclusion, the Vyper package is vulnerable to a buffer overflow when importing functions from a JSON interface that returns bytes. This vulnerability can have severe consequences, including arbitrary code execution and denial of service attacks. It is crucial to update the Vyper package to version 0.3.2 or later to mitigate this vulnerability. Alternatively, using .vy interfaces can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vyper →
FAQ
Vyper is a Python-based programming language designed for writing smart contracts on the Ethereum blockchain. It aims to enhance security and eliminate common pitfalls in Solidity.
The vulnerability can lead to a buffer overflow, potentially resulting in arbitrary code execution or denial of service attacks.
Update the Vyper package to version 0.3.2 or later. The fix has been implemented in commit 049dbdc647b2ce838fae7c188e6bb09cf16e470b.
Yes, you can use .vy interfaces instead of importing functions from a JSON interface that returns bytes.
The CVSS score of this vulnerability is 7.1, indicating a high severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for vyper.
