VulertSecurity VulertSecurity

Vulnerability Database · PyPI · vyper · Version

vyper 0.2.8

0.2.8 is affected by 73 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 0.4.3.

Critical 5 High 15 Medium 26 Low 14 Unrated 13

All vyper versions & vulnerabilities → Source repository Search the database for this package →
Released 04 Dec 2020 Licence MIT Also known from other sources 71 Newer releases 78 Database updated 23/Oct/2026

Release and licence data published by PyPI. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

vyper 0.2.8 vulnerabilities

73 vulnerabilities cover vyper 0.2.8. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2024-24563: Vyper array negative index vulnerability in vyper 9.8 critical 0.4.0 07 Feb 2024
CVE-2024-24563: Vyper Package Allows Signed Integers as Array Indexes Leading to Unpredictable Behavior 9.8 critical 0.4.0b1 07 Feb 2024
CVE-2024-24561: Vyper's bounds check on built-in `slice()` function can be overflowed 9.8 critical 0.4.0 01 Feb 2024
CVE-2024-24561: Vyper Package Slice Bounds Check Overflow Vulnerability 9.8 critical 0.4.0b1 01 Feb 2024
CVE-2024-22419: Vyper Buffer Overflow Vulnerability in concat Function 9.8 critical 55e18f6d128b2da8986adbbcccf1cd59a4b9ad6f 18 Jan 2024
CVE-2022-24845: Integer Bounds Error in Vyper 8.8 high 0.3.2 22 Apr 2022
CVE-2023-42443: Vyper Package Memory Corruption Vulnerability 8.1 high 0.3.10 18 Sep 2023
CVE-2025-21607: Vyper Package Gas Mismanagement in Precompile Calls 7.5 high 0.4.1 14 Jan 2025
CVE-2023-46247: Vyper Package Underallocation Vulnerability in Large Arrays 7.5 high 0bb7203b584e771b23536ba065a6efda457161bb 13 Dec 2023
CVE-2023-46247: Incorrect Storage Layout in Vyper Package 7.5 high 0.3.8 13 Dec 2023
CVE-2023-31146: Vyper vulnerable to OOB DynArray access 7.5 high 0.3.8 12 May 2023
CVE-2023-32058: Vyper Integer Overflow Vulnerability 7.5 high 0.3.8 12 May 2023
CVE-2023-32059: Vyper vulnerable to incorrect ordering of arguments for kwargs passed to internal calls 7.5 high 0.3.8 12 May 2023
CVE-2023-30837: vyper vulnerable to storage allocator overflow 7.5 high 0.3.8 05 May 2023
CVE-2023-30629: Vyper - Incorrect Bytecode Generation 7.5 high 851f7a1b3aa2a36fd041e3d0ed38f9355a58c8ae 24 Apr 2023
CVE-2022-29255: Vyper - Incorrect Evaluation of Contract Address 7.5 high 6b4d8ff185de071252feaa1c319712b2d6577f8d 09 Jun 2022
CVE-2022-29255: Multiple evaluation of contract address in call in vyper 7.5 high 0.3.4 06 Jun 2022
Vulnerability in Vyper Package: Incorrect Comparison in Vyper 7.5 high 0.3.2 04 Apr 2022
CVE-2021-41121: Memory corruption in vyper package 7.5 high 0.3.0 12 Oct 2021
CVE-2022-24788: Buffer Overflow in vyper 7.1 high 0.3.2 20 Apr 2022
CVE-2023-39363: Vyper - Incorrect Allocation of Named Re-Entrancy Locks 5.9 medium No fix published 07 Aug 2023
CVE-2024-32645: vyper - Incorrect Topic Logging in raw_log 5.3 medium 0.4.0 25 Apr 2024
CVE-2024-32646: Vyper - Double Eval Vulnerability in Slice Builtin 5.3 medium 0.4.0 25 Apr 2024
CVE-2024-32647: Vyper - Double Evaluation of Raw Args in create_from_blueprint 5.3 medium 0.4.0 25 Apr 2024
CVE-2024-32648: Vyper - Default Functions Don't Respect Nonreentrancy Keys 5.3 medium 0.3.0 25 Apr 2024
CVE-2024-32649: Vyper - Double Evaluation of sqrt Argument 5.3 medium 0.4.0 25 Apr 2024
CVE-2024-32648: Vyper Package Non-Reentrancy Key Bypass in Default Functions 5.3 medium 93287e5ac184b53b395c907d40701f721daf8177 25 Apr 2024
CVE-2024-32649: Vyper Package Double Evaluation Vulnerability in sqrt Builtin 5.3 medium 0.4.0 25 Apr 2024
CVE-2024-32647: Vyper Package Suffers from Double Eval Vulnerability 5.3 medium 0.4.0 25 Apr 2024
CVE-2024-32646: Vyper Package Suffers from Double Eval Vulnerability in Slice Builtin 5.3 medium 0.4.0 25 Apr 2024
CVE-2024-32645: Vyper Package Logging Issue Leading to Incorrect Topic Values 5.3 medium 0.4.0 25 Apr 2024
CVE-2024-24564: Vyper Package Vulnerability in extract32 Function Leading to Potential Memory Exposure 5.3 medium 3d9c537142fb99b2672f21e2057f5f202cde194f 26 Feb 2024
CVE-2024-26149: Vyper Array Index Overflow Vulnerability 5.3 medium 0.4.0b1 26 Feb 2024
CVE-2024-24559: Vyper Package Stack Management Error in sha3_64 Compilation 5.3 medium 0.4.0b1 05 Feb 2024
CVE-2024-24560: Vyper Smart Contract Language Input Buffer Overlap Vulnerability 5.3 medium 0.4.0b1 02 Feb 2024
CVE-2024-24567: Vyper Vulnerability in Handling Value in Delegatecall and Staticcall 5.3 medium 0.4.0b1 30 Jan 2024
CVE-2023-40015: Vyper - Evaluation Order Vulnerability 5.3 medium 0.3.10rc1 04 Sep 2023
CVE-2023-41052: Vyper - Evaluation Order Vulnerability 5.3 medium 0.3.10rc1 04 Sep 2023
CVE-2023-41052: Vulnerability in vyper - Incorrect Order of Evaluation of Side Effects 5.3 medium 0.3.10rc1 04 Sep 2023
CVE-2023-40015: Vyper - Reversed Order of Side Effects Vulnerability 5.3 medium No fix published 04 Sep 2023
CVE-2023-37902: Vyper - Signature Verification Bypass 5.3 medium 019a37ab98ff53f04fecfadf602b6cd5ac748f7f 25 Jul 2023
CVE-2023-37902: Vyper - ecrecover can return undefined data if signature does not verify 5.3 medium 0.3.10 25 Jul 2023
CVE-2024-24567: Vyper's raw_call `value=` kwargs not disabled for static and delegate calls 4.8 medium 0.4.0 30 Jan 2024
CVE-2021-41122: Vyper - Missing Clamps for Decimal Args in External Functions 4.3 medium 0.3.0 06 Oct 2021
CVE-2024-24564: Vyper's extract32 Can Read Dirty Memory 3.7 low 0.4.0 26 Feb 2024
CVE-2024-26149: Vyper's _abi_decode vulnerable to Memory Overflow 3.7 low 0.4.0 26 Feb 2024
CVE-2024-24559: Vyper sha3 codegen bug 3.7 low 0.4.0 05 Feb 2024
Vulnerability in Vyper: Overflow of Return Data 3.7 low 0.4.0 02 Feb 2024
CVE-2023-32675: Vyper's nonpayable default functions are sometimes payable 3.7 medium 0.3.8 22 May 2023
CVE-2025-47285: Vyper Package - Side-Effect Elision in concat() Builtin for Zero-Length Arguments 2.9 low No fix published 07 Jul 2026
CVE-2025-47774: Vyper Package Slice Function Elides Side-Effects with Zero Length Output 2.9 low No fix published 07 Jul 2026
CVE-2025-47774: Vyper Package Slice Function Elides Side Effects 2.9 low No fix published 16 May 2025
CVE-2025-47285: Vyper Package - Side Effects Elision in concat() for Zero-Length Arguments 2.9 low No fix published 16 May 2025
CVE-2025-27104: Vyper Double Evaluation Vulnerability in For List Iteration 2.3 low 0.4.1 21 Feb 2025
CVE-2025-27105: Vyper AugAssign Evaluation Order Vulnerability Leading to Out-of-Bounds Write 2.3 low 0.4.1 21 Feb 2025
CVE-2025-26622: Vyper sqrt Function Rounding Behavior Vulnerability 2.3 low 0.4.1 21 Feb 2025
CVE-2025-21607: Vyper Compiler Vulnerability in Precompile Calls 2.3 low No fix published 14 Jan 2025
CVE-2025-27105: Vyper DynArray Access Vulnerability Leading to Potential Data Corruption N/A unrated 0.4.1 21 Feb 2025
CVE-2025-27104: Vyper Package Vulnerability Leading to Unexpected Behavior in For Loops N/A unrated 0.4.1 21 Feb 2025
CVE-2025-26622: Vyper Package Square Root Calculation Vulnerability N/A unrated 0.4.1 21 Feb 2025
CVE-2023-32675: Vyper Package Default Function Vulnerability N/A unrated 02339dfda0f3caabad142060d511d10bfe93c520. 19 May 2023
CVE-2023-32059: Vyper - Incorrect Compilation of Internal Calls with Default Arguments N/A unrated c3e68c302aa6e1429946473769dd1232145822ac 11 May 2023
CVE-2023-32058: Vyper - Overflow Vulnerability N/A unrated 3de1415ee77a9244eb04bdb695e249d3ec9ed868 11 May 2023
CVE-2023-31146: Vyper - Out-of-Bounds Array Access N/A unrated 4f8289a81206f767df1900ac48f485d90fc87edb 11 May 2023
CVE-2023-30837: Vyper - Allocation Overflow Vulnerability N/A unrated 0bb7203b584e771b23536ba065a6efda457161bb 08 May 2023
CVE-2022-24845: Vyper - Integer Misinterpretation Vulnerability N/A unrated 049dbdc647b2ce838fae7c188e6bb09cf16e470b 13 Apr 2022
CVE-2022-24788: Buffer Overrun in vyper N/A unrated 049dbdc647b2ce838fae7c188e6bb09cf16e470b 13 Apr 2022
CVE-2022-24787: Vyper - Incorrect Comparison of Bytestrings N/A unrated 2c73f8352635c0a433423a5b94740de1a118e508 04 Apr 2022
CVE-2021-41121: Vyper - Memory Corruption Issue in Function Call N/A unrated 0.3.0 06 Oct 2021
CVE-2021-41122: Vyper - Decimal Argument Validation Logic Error N/A unrated 0.3.0 05 Oct 2021
Memory Corruption Vulnerability in Vyper Package N/A medium 0.2.12 19 Apr 2021
Vulnerability in Vyper Package: Incorrect `returndatasize` when using simple forwarder proxies deployed prior to EIP-1167 adoption N/A low 0.2.9 19 Apr 2021
Vyper Package - Integer Manipulation Vulnerability N/A low No fix published 25 Mar 2020

Looking for another version, or everything Vulert holds for vyper?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About vyper 0.2.8

Is vyper 0.2.8 vulnerable?

Yes. 73 vulnerabilities in the Vulert database cover vyper 0.2.8: 5 critical, 15 high, 26 medium and 14 low, plus 13 not yet rated. The upgrade Vulert recommends is 0.4.3, and each entry above names the fixed version to move to.

Which version of vyper should I use instead of 0.2.8?

0.4.3 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 0.2.8 the latest release of vyper?

No. 0.2.8 was published 04 Dec 2020, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor vyper for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the vyper version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.