Description
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. If an excessively large value is specified as the starting index for an array in `_abi_decode`, it can cause the read position to overflow. This results in the decoding of values outside the intended array bounds, potentially leading to exploitations in contracts that use arrays within `_abi_decode`. This vulnerability affects 0.3.10 and earlier versions.
Published: 2024-02-26
Score: 3.7 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2024-0180 Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. If an excessively large value is specified as the starting index for an array in `_abi_decode`, it can cause the read position to overflow. This results in the decoding of values outside the intended array bounds, potentially leading to exploitations in contracts that use arrays within `_abi_decode`. This vulnerability affects 0.3.10 and earlier versions.
Github GHSA Github GHSA GHSA-9p8r-4xp4-gw5w Vyper's `_abi_decode` vulnerable to Memory Overflow
History

Thu, 16 Jan 2025 20:00:00 +0000

Type Values Removed Values Added
First Time appeared Vyperlang
Vyperlang vyper
Weaknesses NVD-CWE-noinfo
CPEs cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:python:*:*
Vendors & Products Vyperlang
Vyperlang vyper

Subscriptions

Vyperlang Vyper
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2024-08-22T20:44:05.129Z

Reserved: 2024-02-14T17:40:03.690Z

Link: CVE-2024-26149

cve-icon Vulnrichment

Updated: 2024-08-01T23:59:32.573Z

cve-icon NVD

Status : Analyzed

Published: 2024-02-26T20:19:05.853

Modified: 2025-01-16T19:31:59.750

Link: CVE-2024-26149

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses