Low severity3.7NVD Advisory· Published Feb 26, 2024· Updated Jun 17, 2026
CVE-2024-26149
CVE-2024-26149
Description
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. If an excessively large value is specified as the starting index for an array in _abi_decode, it can cause the read position to overflow. This results in the decoding of values outside the intended array bounds, potentially leading to exploitations in contracts that use arrays within _abi_decode. This vulnerability affects 0.3.10 and earlier versions.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
vyperPyPI | < 0.4.0 | 0.4.0 |
Affected products
3Patches
Vulnerability mechanics
References
8- github.com/vyperlang/vyper/security/advisories/GHSA-9p8r-4xp4-gw5wnvdExploitPatchVendor AdvisoryWEB
- github.com/advisories/GHSA-9p8r-4xp4-gw5wghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-26149ghsaADVISORY
- github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2024-164.yamlghsaWEB
- github.com/vyperlang/vyper/pull/3925ghsaWEB
- github.com/vyperlang/vyper/pull/4060ghsaWEB
- github.com/vyperlang/vyper/pull/4091ghsaWEB
- github.com/vyperlang/vyper/pull/4144ghsaWEB
News mentions
0No linked articles in our index yet.