CVE-2022-24788
highpriority · track · 39EPSS 0.010 · 62 %ileEUUSEPSS · scored 2026-10-27
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Versions of vyper prior to 0.3.2 suffer from a potential buffer overrun. Importing a function from a JSON interface which returns `bytes` generates bytecode which does not clamp bytes length, potentially resulting in a buffer overrun. Users are advised to upgrade. There are no known workarounds for this issue.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.1–9.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-4mrx-6fxm-8jpgBuffer Overflow in vyper2022-04-20ghsa · osvUS
### Impact Importing a function from a JSON interface which returns `bytes` generates bytecode which does not clamp bytes length, potentially resulting in a buffer overrun. ### Patches 0.3.2 (as of https://github.com/vyperlang/vyper/commit/049dbdc647b2ce838fae7c188e6bb09cf16e470b) ### Workarounds Use .vy interfaces.
- PYSEC-2022-1972022-04-13vendor · osvUS
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Versions of vyper prior to 0.3.2 suffer from a potential buffer overrun. Importing a function from a JSON interface which returns `bytes` generates bytecode which does not clamp bytes length, potentially resulting in a buffer overrun. Users are advised to upgrade. There are no known workarounds for this issue.
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (8)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2022-24788/cnnvd
- https://github.com/vyperlang/vyper/commit/049dbdc647b2ce838fae7c188e6bb09cf16e470bcnnvd
- https://github.com/vyperlang/vyper/security/advisories/GHSA-4mrx-6fxm-8jpgcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2022-24788cnnvd
- https://github.com/vyperlang/vyper/commit/049dbdc647b2ce838fae7c188e6bb09cf16e470benisa_euvd
- https://github.com/vyperlang/vyper/security/advisories/GHSA-4mrx-6fxm-8jpgenisa_euvd
- https://github.com/vyperlang/vyper/commit/049dbdc647b2ce838fae7c188e6bb09cf16e470bPatchThird Party Advisorynvd
- https://github.com/vyperlang/vyper/security/advisories/GHSA-4mrx-6fxm-8jpgPatchThird Party Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan