CVE-2023-32058

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, due to missing overflow check for loop variables, by assigning the iterator of a loop to a variable, it is possible to overflow the type of the latter. The issue seems to happen only in loops of type `for i in range(a, a + N)` as in loops of type `for i in range(start, stop)` and `for i in range(stop)`, the compiler is able to raise a `TypeMismatch` when trying to overflow the variable. The problem has been patched in version 0.3.8.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
May 11, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-320597.5Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, internal calls with default arguments CVE-2023-32067.5A vulnerability classified as problematic was found in Chengdu VEC40G 3.0. Affected by this vulnerability is an unknown functionality of theCVE-2023-320606.5DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.35 branch and prior tCVE-2023-320615.3Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `teCVE-2023-320624.3OroPlatform is a package that assists system and user calendar management. Back-office users can access information from any system calendarCVE-2023-320635.0OroCalendarBundle enables a Calendar feature and related functionality in Oro applications. Back-office users can access information from anCVE-2023-320644.3OroCommerce package with customer portal and non authenticated visitor website base features. Back-office users can access information aboutCVE-2023-320655.8OroCommerce is an open-source Business to Business Commerce application built with flexibility in mind. Detailed Order totals information maCVE-2023-320665.4Time Tracker is an open source time tracking system. The week view plugin in Time Tracker versions 1.22.11.5782 and prior was not escaping tCVE-2023-320677.5c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forgCVE-2023-320686.1XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 14.10.4 it's pCVE-2023-320698.8XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-2 and prior to versions 14.10.4 and 15.0-rc-1, it's possible fo
CVE-2023-32058: High severity, CVSS 7.5 | Vulnix