[ CVE-2020-37288 · Published 21 Oct 2026 ]
Vulnerability in vyperlang vyper
CVSS 3.7
EPSS <1%No fix listed yet
[ Description ]Official description
Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination (stack underflow). Affected contracts revert such calls unnecessarily, which in limited circumstances could enable denial of service against public contracts.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.