CVE-2023-39363

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-39363
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-39363.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-39363
Aliases
Published
2023-08-07T18:40:25.615Z
Modified
2025-12-05T00:01:58.529943Z
Severity
  • 9.1 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:A CVSS Calculator
Summary
Vyper incorrectly allocated named re-entrancy locks
Details

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in contracts compiled with the susceptible versions. A specific set of conditions is required to result in misbehavior of affected contracts, specifically: a .vy contract compiled with vyper versions 0.2.15, 0.2.16, or 0.3.0; a primary function that utilizes the @nonreentrant decorator with a specific key and does not strictly follow the check-effects-interaction pattern (i.e. contains an external call to an untrusted party before storage updates); and a secondary function that utilizes the same key and would be affected by the improper state caused by the primary function. Version 0.3.1 contains a fix for this issue.

Database specific 
{
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39363.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git /

Affected ranges