CVE-2025-47285 Details
Description
Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, `concat()` may skip evaluation of side effects when the length of an argument is zero. This is due to a fastpath in the implementation which skips evaluation of argument expressions when their length is zero. In practice, it would be very unusual in user code to construct zero-length bytestrings using an expression with side-effects, since zero-length bytestrings are typically constructed with the empty literal `b""`; the only way to construct an empty bytestring which has side effects would be with the ternary operator introduced in v0.3.8, e.g. `b"" if self.do_some_side_effect() else b""`. The fix is available in pull request 4644 and expected to be part of the 0.4.2 release. As a workaround, don't have side effects in expressions which construct zero-length bytestrings.
A vulnerability exists in the Vyper programming language for the Ethereum Virtual Machine, specifically in versions through 0.4.2rc1. The issue arises in the 'concat()' function, which may inadvertently skip evaluating side effects when an argument's length is zero. This behavior results from an optimization that bypasses the evaluation of argument expressions with zero length. While it's uncommon for users to create zero-length bytestrings with side effects—since they are usually made with the empty literal 'b""'—it can be done using the ternary operator introduced in Vyper 0.3.8. The vulnerability is considered low severity because the pattern of constructing empty bytestrings with side effects is rare in typical user code.
Users can avoid this vulnerability by ensuring that expressions creating zero-length bytestrings do not include side effects. For those using Vyper versions 0.4.2rc1 or earlier, be cautious with the 'concat()' function and the construction of empty bytestrings.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 15, 2025CISA-ADP
Assessed May 15, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/vyperlang/vyper/blob/68b68c4b30c5ef2f312b4674676170b8a6eaa316/vyper/builtins/functions.py#L560-L562 | [email protected] | Source CodeVendor |
| https://github.com/vyperlang/vyper/pull/4644 | [email protected] | Issue TrackingVendor |
| https://github.com/vyperlang/vyper/security/advisories/GHSA-qhr6-mgqr-mchm | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-691 | Insufficient Control Flow Management | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vyper | < 0.4.2 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 15, 2025 | New CVE Received | [email protected] |