Bug 2565623

Summary: CVE-2020-37288 vyper: vyper: Denial of Service via invalid jump destination in nested loops [fedora-all]
Product: [Fedora] Fedora Reporter: TEJ RATHI <trathi>
Component: vyperAssignee: Peter Lemenkov <lemenkov>
Status: CLOSED CURRENTRELEASE QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: rawhideCC: lemenkov
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["0c343426-aaa1-4383-9a47-075a52a364ea"]}
Fixed In Version: vyper-0.2.3 Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2026-11-03 07:45:58 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2558019    

Description TEJ RATHI 2026-11-03 07:44:23 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination (stack underflow). Affected contracts revert such calls unnecessarily, which in limited circumstances could enable denial of service against public contracts.
Comment 1 Peter Lemenkov 2026-11-03 07:45:58 UTC 
This was fixed upstream in vyper 0.2.3 (GHSA-vg88-3v92-rjx2 / VVE-2020-0002, published 2020-07-16).

All Fedora releases ship vyper 0.4.3, which already contains the fix and is not affected.