Vyper is a domain-specific programming language designed for smart contract development on the Ethereum Virtual Machine, and its vulnerability footprint reflects the safety-critical nature of that role. Vulnerabilities affecting the language's compiler and runtime lean toward serious outcomes, with an elevated share reaching critical severity, reflecting the high stakes of flaws that can result in cryptocurrency loss or contract compromise. The exposure concentrates in the single Vyper product and recurs through weakness classes including control flow implementation errors, buffer-bounds violations, out-of-bounds writes, and incorrect calculations—defects that arise from the compiler's handling of arithmetic, memory layout, and bytecode generation and that can lead to unintended contract behavior when compiled code diverges from developer intent. Defenders and developers using Vyper should treat language and compiler updates as high-priority, particularly where contracts handle significant assets or access controls; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Vyperlang over time
Signals from CVEs in this vendor scope (38 CVEs).
38 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-24788CRITICAL Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Versions of vyper prior to 0.3.2 suffer from a potential buffer overrun. Importing a function from a J | Apr 13, 2022 | 9.8 | 31 | NO | NO |
CVE-2024-24561CRITICAL Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.10 and earlier, the bounds check for slices does not account for the ability for start | Feb 1, 2024 | 9.8 | 30 | NO | NO |
CVE-2024-24563CRITICAL Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. Arrays can be keyed by a signed integer, while they are defined for unsigned integers only. The typech | Feb 7, 2024 | 9.8 | 27 | NO | NO |
CVE-2023-31146CRITICAL Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, during codegen, the length word of a dynarray is written before the data, whic | May 11, 2023 | 9.1 | 27 | NO | NO |
CVE-2021-41121HIGH Vyper is a Pythonic Smart Contract Language for the EVM. In affected versions when performing a function call inside a literal struct, there is a memory corruption issue that occur | Oct 6, 2021 | 8.8 | 27 | NO | NO |
CVE-2025-27105CRITICAL vyper is a Pythonic Smart Contract Language for the EVM. Vyper handles AugAssign statements by first caching the target location to avoid double evaluation. However, in the case wh | Feb 21, 2025 | 9.1 | 26 | NO | NO |
CVE-2024-22419CRITICAL Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. The `concat` built-in can write over the bounds of the memory buffer that was allocated for it and thu | Jan 18, 2024 | 9.8 | 26 | NO | NO |
CVE-2022-24787HIGH Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. In version 0.3.1 and prior, bytestrings can have dirty bytes in them, resulting in the word-for-word c | Apr 4, 2022 | 7.5 | 25 | NO | NO |
CVE-2023-32058HIGH Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, due to missing overflow check for loop variables, by assigning the iterator of | May 11, 2023 | 7.5 | 24 | NO | NO |
CVE-2023-30837HIGH Vyper is a pythonic smart contract language for the EVM. The storage allocator does not guard against allocation overflows in versions prior to 0.3.8. An attacker can overwrite the | May 8, 2023 | 7.5 | 24 | NO | NO |
Signals from CVEs in this vendor scope (38 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Vyperlang.
Media articles that mention a CVE ID that affects a product developed by Vyperlang — matched by CVE ID, not by vendor name.