Bug 2558000 (CVE-2021-48019)

Summary: CVE-2021-48019 vyper: vyper: data corruption via fixed return data size in forwarder proxies
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Vyper. Forwarder proxies created using the built-in create_forwarder_to function report a fixed return data size instead of the actual data length returned by the target contract. A remote caller or interacting smart contract can encounter data corruption when returned payloads exceed the fixed limit without proper sanitization. Additionally, external callers that strictly validate return data length may fail assertions, leading to unexpected transaction reverts and Denial of Service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2565617    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-21 00:59:09 UTC 
Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data when a function returns more than 4096 bytes without return data sanitation, and fail strict return-size checks such as SafeERC20.safeTransfer.