Description
Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination (stack underflow). Affected contracts revert such calls unnecessarily, which in limited circumstances could enable denial of service against public contracts.
Metrics
CVSS 3.1 3.7/10
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:LWeakness enumeration
Affected software
Source: the vendor's advisory (CNA). NVD analysis pending.
No affected versions have been published.
Timeline
- Published
- Oct 21, 2026
- Last modified
- Oct 22, 2026
- NVD status
- Awaiting Analysis