CVE-2021-41121: Memory corruption in vyper package
Summary
CVE-2021-41121: Memory corruption when returning a literal struct with a private call inside of it. Affects vyper versions < 0.3.0. Fixed in 0.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vyper package is a Python package available on PyPI. It is used for writing smart contracts for the Ethereum blockchain. Vyper provides a higher-level language compared to Solidity, making it easier to write secure and efficient smart contracts. However, a vulnerability has been identified in the package that can lead to memory corruption.
Vulnerability Detail
The vulnerability in vyper occurs when a function call is performed inside a literal struct. Due to an incorrect pointer to the top of the stack, a memory corruption issue arises. This vulnerability has a high severity level with a CVSS score of 7.5. If exploited, it can lead to various consequences, including unauthorized access, data manipulation, and potential remote code execution.
How To Fix
Latest published version: 0.4.3 as of 22 Oct 2026
pip install --upgrade "vyper==0.4.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.3.0
This is the first release that contains the fix.
pip install --upgrade "vyper==0.3.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is crucial to update the package to the fixed version as soon as possible.
Conclusion
In conclusion, the vyper package is vulnerable to a memory corruption issue that can have severe consequences if exploited. It is crucial for users to update their package to version 0.3.0 or higher to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vyper →
FAQ
The vyper package is used for writing smart contracts for the Ethereum blockchain. It provides a higher-level language compared to Solidity.
The vulnerability can lead to memory corruption, which may result in unauthorized access, data manipulation, and potential remote code execution.
To fix this vulnerability, update the vyper package to version 0.3.0 or higher using the command: pip install --upgrade vyper.
No, there is no specific workaround available for this vulnerability. Updating the package is the recommended solution.
The vulnerability has a high severity level with a CVSS score of 7.5.
References
Related vulnerabilities
Recent vulnerabilities recorded for vyper.
