VulertSecurity VulertSecurity

Vulnerability Database · PyPI · Package report

vyper: vulnerability history, versions and safety

vyper is a package in the PyPI ecosystem. Vulert records 87 vulnerabilities for it across 78 releases, from Mar 2020 to Oct 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
87 vulnerabilities recorded C3 H14 M18 L12 U40
i
8 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
5 in the last 12 months

Most recent disclosure 06 Oct 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all vyper vulnerabilities

Vulert verdict on vyper 0.4.3 i

Updated on 23 Oct 2026

Careful: 0.4.3 has 20 known vulnerabilities, and 8 have no fix yet. Use an earlier safe version, or the workaround listed for each one.

Package health score 50/100
  • Security Unfixed issues
  • Maintenance Maintaining
  • Popularity Widely used
  • Community Active

The current release has a vulnerability with no published fix, which caps this score.

What to do: Pin an earlier, unaffected release if you can, and apply the workaround each vulnerability lists until a fix is published. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release 0.4.3 — affected i
  • Vulnerabilities on record 87 over 6 years · 5 in the last year i
  • Latest disclosure 06 Oct 2026 i
  • Highest CVSS 9.8 i
  • With no published fix 8 i
  • Depended on by 36 packages i
  • Stars 5,183 i
  • OpenSSF scorecard 7/10 i
  • Last release 16 months ago i
  • Licence Apache-2.0 i
  • Similar names typer i

Version list, release dates, licence and dependants published by PyPI, refreshed 22 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for vyper, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
0.5.0b1 01 Sep 2026 M1 L4 U15 Apache-2.0 No Details →
0.5.0a3 14 Jun 2026 M1 L4 U15 Apache-2.0 No Details →
0.5.0a2 29 May 2026 M1 L4 U15 Apache-2.0 No Details →
0.5.0a1 07 May 2026 M1 L4 U15 Apache-2.0 No Details →
0.4.3 18 Jun 2025 M1 L4 U15 Apache-2.0 No Details →
0.4.3rc1 17 Jun 2025 M1 L4 U15 Apache-2.0 No Details →
0.4.2 31 May 2025 M1 Apache-2.0 No Details →
0.4.2rc1 02 May 2025 M1 L2 U2 Apache-2.0 No Details →
0.4.1 01 Mar 2025 M1 L3 U2 Apache-2.0 No Details →
0.4.1rc3 25 Feb 2025 M1 L6 U6 Apache-2.0 No Details →
0.4.1rc2 21 Feb 2025 M1 L6 U6 Apache-2.0 No Details →
0.4.1rc1 20 Jan 2025 M1 L6 U6 Apache-2.0 No Details →
0.4.1b4 04 Jan 2025 M1 L6 U6 Apache-2.0 No Details →
0.4.1b3 15 Dec 2024 M1 L6 U6 Apache-2.0 No Details →
0.4.1b2 25 Nov 2024 M1 L6 U6 Apache-2.0 No Details →
0.4.1b1 15 Oct 2024 M1 L6 U6 Apache-2.0 No Details →
0.4.0 20 Jun 2024 M1 L6 U6 Apache-2.0 No Details →
0.4.0rc6 30 May 2024 C2 H1 M6 L10 U11 Apache-2.0 No Details →
0.4.0rc5 16 May 2024 C2 H1 M6 L10 U11 Apache-2.0 No Details →
0.4.0rc4 15 May 2024 C2 H1 M6 L10 U11 Apache-2.0 No Details →
0.4.0rc3 08 May 2024 C2 H1 M6 L10 U11 Apache-2.0 No Details →
0.4.0rc2 14 Apr 2024 C2 H1 M7 L10 U11 Apache-2.0 No Details →
0.4.0rc1 10 Apr 2024 C2 H1 M7 L10 U11 Apache-2.0 No Details →
0.4.0b6 06 Apr 2024 C2 H1 M7 L10 U11 Apache-2.0 No Details →
0.4.0b5 12 Mar 2024 C2 H1 M7 L10 U11 Apache-2.0 No Details →
0.4.0b4 08 Mar 2024 C2 H1 M7 L10 U11 Apache-2.0 No Details →
0.4.0b3 06 Mar 2024 C2 H1 M7 L10 U11 Apache-2.0 No Details →
0.4.0b2 05 Mar 2024 C2 H1 M7 L10 U11 Apache-2.0 No Details →
0.4.0b1 26 Feb 2024 C2 H1 M7 L10 U11 Apache-2.0 No Details →
0.3.10 04 Oct 2023 C2 H1 M7 L10 U19 Apache-2.0 No Details →
0.3.10rc5 28 Sep 2023 C2 H2 M10 L10 U22 Apache-2.0 No Details →
0.3.10rc4 27 Sep 2023 C2 H2 M10 L10 U22 Apache-2.0 No Details →
0.3.10rc3 08 Sep 2023 C2 H2 M10 L10 U22 Apache-2.0 No Details →
0.3.10rc2 06 Sep 2023 C2 H2 M10 L10 U22 Apache-2.0 No Details →
0.3.10rc1 06 Sep 2023 C2 H2 M10 L10 U22 Apache-2.0 No Details →
0.3.9 29 May 2023 C2 H2 M11 L10 U25 Apache-2.0 No Details →
0.3.8 23 May 2023 C2 H2 M11 L10 U26 Apache-2.0 No Details →
0.3.7 27 Sep 2022 C2 H8 M11 L10 U32 Apache-2.0 No Details →
0.3.6 06 Aug 2022 C2 H8 M11 L10 U32 Apache-2.0 No Details →
0.3.5 06 Aug 2022 C2 H8 M11 L10 U32 Apache-2.0 No Details →
0.3.4 27 Jul 2022 C2 H8 M11 L10 U32 Apache-2.0 No Details →
0.3.3 22 Apr 2022 C2 H8 M10 L10 U32 Apache-2.0 No Details →
0.3.2 19 Apr 2022 C2 H8 M10 L10 U32 Apache-2.0 No Details →
0.3.1 01 Dec 2021 C2 H11 M10 L10 U35 Apache-2.0 No Details →
0.3.0 05 Oct 2021 C3 H10 M10 L10 U34 Apache-2.0 No Details →
0.2.16 28 Aug 2021 C3 H10 M12 L10 U37 Apache-2.0 No Details →
0.2.15 24 Jul 2021 C3 H10 M12 L10 U37 Apache-2.0 No Details →
0.2.14 20 Jul 2021 C2 H11 M12 L10 U37 Apache-2.0 No Details →
0.2.13 06 Jul 2021 C2 H11 M12 L10 U37 Apache-2.0 No Details →
0.2.12 16 Apr 2021 C2 H10 M12 L10 U37 Apache-2.0 No Details →
0.2.11 28 Feb 2021 C2 H10 M13 L10 U37 Apache-2.0 No Details →
0.2.10 17 Feb 2021 C2 H10 M13 L10 U37 Apache-2.0 No Details →
0.2.9 17 Feb 2021 C2 H10 M13 L10 U37 Apache-2.0 No Details →
0.2.8 04 Dec 2020 C2 H10 M12 L11 U36 MIT No Details →
0.2.7 15 Oct 2020 C2 H10 M12 L11 U36 MIT No Details →
0.2.6 10 Oct 2020 C2 H10 M12 L11 U36 MIT No Details →
0.2.5 30 Sep 2020 C2 H10 M14 L11 U36 MIT No Details →
0.2.4 04 Aug 2020 C2 H10 M14 L11 U36 MIT No Details →
0.2.3 16 Jul 2020 C2 H10 M14 L11 U36 MIT No Details →
0.2.2 04 Jul 2020 C2 H10 M15 L11 U36 MIT No Details →
0.2.1 03 Jul 2020 C2 H10 M15 L11 U36 MIT No Details →
0.1.0b17 24 Mar 2020 C2 H10 M15 L11 U36 MIT No Details →
0.1.0b16 09 Jan 2020 C2 H10 M15 L12 U36 MIT No Details →
0.1.0b15 07 Jan 2020 C2 H10 M15 L12 U36 MIT No Details →
0.1.0b14 13 Nov 2019 C2 H10 M15 L12 U36 MIT No Details →
0.1.0b13 27 Sep 2019 C2 H10 M15 L12 U36 MIT No Details →
0.1.0b12 28 Aug 2019 C2 H10 M15 L12 U36 MIT No Details →
0.1.0b11 23 Jul 2019 C2 H10 M15 L12 U36 MIT No Details →
0.1.0b10 24 May 2019 C2 H10 M15 L12 U36 MIT No Details →
0.1.0b9 12 Mar 2019 C2 H10 M14 L12 U36 MIT No Details →
0.1.0b8 06 Feb 2019 C2 H10 M14 L12 U36 MIT No Details →
0.1.0b7 18 Jan 2019 C2 H10 M14 L12 U36 MIT No Details →
0.1.0b6 13 Dec 2018 C2 H10 M14 L12 U36 MIT No Details →
0.1.0b5 30 Nov 2018 C2 H10 M14 L12 U36 MIT No Details →
0.1.0b4 19 Oct 2018 C2 H10 M14 L12 U36 MIT No Details →
0.1.0b3 25 Sep 2018 C2 H10 M14 L12 U36 MIT No Details →
0.1.0b2 22 Aug 2018 C2 H10 M14 L12 U36 MIT No Details →
0.1.0b1 22 Aug 2018 C2 H10 M14 L12 U36 MIT No Details →

All 78 versions Vulert tracks for this package. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2020 1
  • 2021 7
  • 2022 8
  • 2023 28
  • 2024 28
  • 2025 10
  • 2026 5

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 5 of the 87 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for vyper

The 5 most severe of 87 vulnerabilities recorded for this package

Search all 87 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2024-24563: Vyper array negative index vulnerability in vyper 9.8 critical 0.4.0 07 Feb 2024
CVE-2024-24563: Vyper Package Allows Signed Integers as Array Indexes Leading to Unpredictable Behavior 9.8 critical 0.4.0b1 07 Feb 2024
CVE-2024-24561: Vyper's bounds check on built-in `slice()` function can be overflowed 9.8 critical 0.4.0 01 Feb 2024
CVE-2024-22419: Vyper Buffer Overflow Vulnerability in concat Function 9.8 critical 55e18f6d128b2da8986adbbcccf1cd59a4b9ad6f 18 Jan 2024
CVE-2024-24561: Vyper Package Slice Bounds Check Overflow Vulnerability 9.8 critical 0.4.0b1 01 Feb 2024

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About vyper

Is vyper safe to use?

Vulert records 87 vulnerabilities for vyper in PyPI: 3 critical, 14 high, 18 medium and 12 low, plus 40 not yet rated. 8 of them have no published fix yet, so those are the ones to avoid or mitigate.

What is vyper's Vulert package health score?

Vulert scores vyper 50/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15). The current release has a vulnerability with no published fix, which caps this score.

Is the latest version of vyper affected?

Yes. 0.4.3, the version you would install today, has 20 known vulnerabilities, and 8 has no published fix yet. Use an earlier unaffected release, or the workaround each vulnerability lists.

Which version of vyper should I use?

0.4.3 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does vyper have?

87 vulnerabilities are recorded for vyper in the PyPI ecosystem: 3 critical, 14 high, 18 medium and 12 low, plus 40 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new vyper vulnerabilities disclosed?

5 vulnerabilities were recorded for vyper in the last 12 months, and the oldest entry in this database dates to 25 Mar 2020. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of vyper are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor vyper for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the vyper version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.