https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 18 Oct 2026 22:18:49 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-242349 EUVD-2026-242349 https://cve.radiocsirt.org/vuln/euvd-2026-242349 https://cve.radiocsirt.org/vuln/fkie_cve-2024-22419 <p>Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. The `concat` built-in can write over the bounds of the memory buffer that was allocated for it and thus overwrite existing valid data. The root cause is that the `build_IR` for `concat` doesn&#39;t properly adhere to the API of copy functions (for `&gt;=0.3.2` the `copy_bytes` function). A contract search was performed and no vulnerable contracts were found in production. The buffer overflow can result in the change of semantics of the contract. The overflow is length-dependent and thus it might go unnoticed during contract testing. However, certainly not all usages of concat will result in overwritten valid data as we require it to be in an internal function and close to the return statement where other memory allocations don&#39;t occur. This issue has been addressed in 0.4.0.</p> <p>Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. The `concat` built-in can write over the bounds of the memory buffer that was allocated for it and thus overwrite existing valid data. The root cause is that the `build_IR` for `concat` doesn&#39;t properly adhere to the API of copy functions (for `&gt;=0.3.2` the `copy_bytes` function). A contract search was performed and no vulnerable contracts were found in production. The buffer overflow can result in the change of semantics of the contract. The overflow is length-dependent and thus it might go unnoticed during contract testing. However, certainly not all usages of concat will result in overwritten valid data as we require it to be in an internal function and close to the return statement where other memory allocations don&#39;t occur. This issue has been addressed in 0.4.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-22419 https://cve.radiocsirt.org/vuln/ghsa-2q8v-3gqq-4f8p <p><strong>Affected:</strong> PyPI: vyper</p> <p>### Summary `concat` built-in can write over the bounds of the memory buffer that was allocated for it and thus overwrite existing valid data. The root cause is that the `build_IR` for `concat` doesn&#39;t properly adhere to the API of copy functions (for `&gt;=0.3.2` the `copy_bytes` function).</p> <p>A contract search was performed and no vulnerable contracts were found in production.</p> <p>Tracked in issue https://github.com/vyperlang/vyper/issues/3737</p> <p>### Details The `build_IR` allocates a new internal variable for the concatenation: https://github.com/vyperlang/vyper/blob/3b310d5292c4d1448e673d7b3adb223f9353260e/vyper/builtins/functions.py#L534-L550</p> <p>Notice that the buffer is allocated for the `maxlen` + 1 word to actually hold the length of the array.</p> <p>Later the `copy_bytes` function is used to copy the actual source arguments to the destination: https://github.com/vyperlang/vyper/blob/3b310d5292c4d1448e673d7b3adb223f9353260e/vyper/builtins/functions.py#L569-L572</p> <p>The `dst_data` is defined via: - `data ptr` - to skip the 1 word that holds the length - `offset` - to skip the source arguments that were already written to the buffer - the `offset` is increased via: `[&#34;set&#34;, ofst, [&#34;add&#34;, ofst, arglen]]`, ie it is increased by the length of the source argument</p> <p>Now, the `copy_bytes` function has multiple control flow paths, the following ones are of interest: 1) https://github.com/vyperlang/vyper/blob/3b310d5292c4d1448e673d7b3adb223f9353260e/vyper/codegen/core.py#L270-L273 2) https://g…</p> <p><strong>Affected:</strong> PyPI: vyper</p> <p>### Summary `concat` built-in can write over the bounds of the memory buffer that was allocated for it and thus overwrite existing valid data. The root cause is that the `build_IR` for `concat` doesn&#39;t properly adhere to the API of copy functions (for `&gt;=0.3.2` the `copy_bytes` function).</p> <p>A contract search was performed and no vulnerable contracts were found in production.</p> <p>Tracked in issue https://github.com/vyperlang/vyper/issues/3737</p> <p>### Details The `build_IR` allocates a new internal variable for the concatenation: https://github.com/vyperlang/vyper/blob/3b310d5292c4d1448e673d7b3adb223f9353260e/vyper/builtins/functions.py#L534-L550</p> <p>Notice that the buffer is allocated for the `maxlen` + 1 word to actually hold the length of the array.</p> <p>Later the `copy_bytes` function is used to copy the actual source arguments to the destination: https://github.com/vyperlang/vyper/blob/3b310d5292c4d1448e673d7b3adb223f9353260e/vyper/builtins/functions.py#L569-L572</p> <p>The `dst_data` is defined via: - `data ptr` - to skip the 1 word that holds the length - `offset` - to skip the source arguments that were already written to the buffer - the `offset` is increased via: `[&#34;set&#34;, ofst, [&#34;add&#34;, ofst, arglen]]`, ie it is increased by the length of the source argument</p> <p>Now, the `copy_bytes` function has multiple control flow paths, the following ones are of interest: 1) https://github.com/vyperlang/vyper/blob/3b310d5292c4d1448e673d7b3adb223f9353260e/vyper/codegen/core.py#L270-L273 2) https://g…</p> https://cve.radiocsirt.org/vuln/ghsa-2q8v-3gqq-4f8p https://cve.radiocsirt.org/vuln/gsd-2024-22419 gsd-2024-22419 https://cve.radiocsirt.org/vuln/gsd-2024-22419 https://cve.radiocsirt.org/vuln/pysec-2024-103 <p><strong>Affected:</strong> PyPI: vyper</p> <p>Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. The `concat` built-in can write over the bounds of the memory buffer that was allocated for it and thus overwrite existing valid data. The root cause is that the `build_IR` for `concat` doesn&#39;t properly adhere to the API of copy functions (for `&gt;=0.3.2` the `copy_bytes` function). A contract search was performed and no vulnerable contracts were found in production. The buffer overflow can result in the change of semantics of the contract. The overflow is length-dependent and thus it might go unnoticed during contract testing. However, certainly not all usages of concat will result in overwritten valid data as we require it to be in an internal function and close to the return statement where other memory allocations don&#39;t occur. This issue has been addressed in 0.4.0.</p> <p><strong>Affected:</strong> PyPI: vyper</p> <p>Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. The `concat` built-in can write over the bounds of the memory buffer that was allocated for it and thus overwrite existing valid data. The root cause is that the `build_IR` for `concat` doesn&#39;t properly adhere to the API of copy functions (for `&gt;=0.3.2` the `copy_bytes` function). A contract search was performed and no vulnerable contracts were found in production. The buffer overflow can result in the change of semantics of the contract. The overflow is length-dependent and thus it might go unnoticed during contract testing. However, certainly not all usages of concat will result in overwritten valid data as we require it to be in an internal function and close to the return statement where other memory allocations don&#39;t occur. This issue has been addressed in 0.4.0.</p> https://cve.radiocsirt.org/vuln/pysec-2024-103