CVE-2022-24788: Vyperlang Vyper

Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days.

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Versions of vyper prior to 0.3.2 suffer from a potential buffer overrun. Importing a function from a JSON interface which returns `bytes` generates bytecode which does not clamp bytes length, potentially resulting in a buffer overrun. Users are advised to upgrade. There are no known workarounds for this issue.

Affected products

• Vyperlang Vyper: before 0.3.2 (fixed in 0.3.2)

Published 2022-04-13. Last modified 2026-06-17.