CVE-2020-37286

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-37286
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-37286.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-37286
Aliases
Published
2026-10-21T01:17:18Z
Modified
2026-10-29T02:46:39Z
Severity
  • 8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
[none]
Details

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested calls. Contracts using such calls as tuple elements, call arguments, or builtin arguments like concat or ecrecover can return corrupted values or pass wrong arguments to external calls.

References

Affected packages

Git / github.com/vyperlang/vyper

Affected ranges

Type
GIT
Repo
https://github.com/vyperlang/vyper
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8a23febbb2d523f3701f9a7d0aaf361c104a2a37
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0.1.0b4"
                },
                {
                    "fixed": "0.3.0"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

Affected versions

0.*
0.2.1
v0.*
v0.0.4
v0.1.0-beta.1
v0.1.0-beta.10
v0.1.0-beta.11
v0.1.0-beta.12
v0.1.0-beta.13
v0.1.0-beta.14
v0.1.0-beta.15
v0.1.0-beta.16
v0.1.0-beta.17
v0.1.0-beta.2
v0.1.0-beta.3
v0.1.0-beta.5
v0.1.0-beta.6
v0.1.0-beta.7
v0.1.0-beta.8
v0.1.0-beta.9
v0.2.0
v0.2.1
v0.2.10
v0.2.11
v0.2.12
v0.2.13
v0.2.14
v0.2.15
v0.2.16
v0.2.2
v0.2.3
v0.2.4
v0.2.5
v0.2.6
v0.2.7
v0.2.8
v0.2.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-37286.json"