CVE-2020-37286 Details
Description
Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested calls. Contracts using such calls as tuple elements, call arguments, or builtin arguments like concat or ecrecover can return corrupted values or pass wrong arguments to external calls.
A memory corruption vulnerability has been identified in Vyper versions 0.1.0b4 prior to 0.3.0. This issue arises from an incorrect stack tip pointer when internal function calls are made within tuples or nested calls. Contracts that utilize such calls as tuple elements, function call arguments, or built-in arguments for functions like 'concat' or 'ecrecover' may return corrupted values or pass incorrect arguments to external calls.
Users can upgrade to Vyper version 0.3.0, which addresses this vulnerability by implementing a new internal calling convention that corrects the stack pointer issue. Vyper versions 0.2.6 and 0.2.16 also contain fixes for specific cases of this vulnerability, but version 0.3.0 is the recommended update for a complete resolution.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Vyper | >= 0.1.0b4, < 0.3.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 27, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | [email protected] |