CVE-2023-32675

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In contracts with more than one regular nonpayable function, it is possible to send funds to the default function, even if the default function is marked `nonpayable`. This applies to contracts compiled with vyper versions prior to 0.3.8. This issue was fixed by the removal of the global `calldatasize` check in commit `02339dfda`. Users are advised to upgrade to version 0.3.8. Users unable to upgrade should avoid use of nonpayable default functions.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-670

Affected software

No affected versions have been published.

Timeline

Published: May 19, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-326767.2Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was found in the Install a CVE-2023-326773.1Zulip is an open-source team collaboration tool with unique topic-based threading. Zulip administrators can configure Zulip to limit who can CVE-2023-326786.5Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat. Users who used to be subscribed to CVE-2023-326797.2Craft CMS is an open source content management system. In affected versions of Craft CMS an unrestricted file extension may lead to Remote C CVE-2023-32687.1An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c in the relayfs. This CVE-2023-326809.6Metabase is an open source business analytics engine. To edit SQL Snippets, Metabase should have required people to be in at least one group CVE-2023-326816.1Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirect CVE-2023-326825.4Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactiva CVE-2023-326835.4Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. A discovered oEmbed or image URL can bypass the `url_p CVE-2023-326842.5Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to version 0.16.0, a virtual machine instance with a CVE-2023-326855.4Kanboard is project management software that focuses on the Kanban methodology. Due to improper handling of elements under the `contentEdita CVE-2023-326865.4Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS allows users to upload attachments to te