Bug 2565625

Summary: CVE-2021-48020 vyper: vyper: Memory corruption via internal function calls within arrays [fedora-all]
Product: [Fedora] Fedora Reporter: TEJ RATHI <trathi>
Component: vyperAssignee: Peter Lemenkov <lemenkov>
Status: CLOSED CURRENTRELEASE QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: rawhideCC: lemenkov
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["63e09a99-3c02-4b1f-9353-90b45437f396"]}
Fixed In Version: vyper-0.3.0 Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2026-11-03 07:52:35 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2558013    

Description TEJ RATHI 2026-11-03 07:47:10 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are performed inside arrays. Contracts placing internal calls in nested array elements, external call arguments, struct literals, or raw_log topics can have memory corrupted, producing incorrect contract behavior.
Comment 1 Peter Lemenkov 2026-11-03 07:52:35 UTC 
This was fixed upstream in vyper 0.3.0 (GHSA-22wc-c9wj-6q2v, published 2021-04-16).

All Fedora releases ship vyper 0.4.3, which already contains the fix and is not affected.