Dashboard / CVE-2021-48020

CVE-2021-48020

HIGH
MEDIUM Priority: 0.02 BB Relevance: 77/100
Published: 2026-10-21 Modified: 2026-10-28 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
AT: Present
VC: None
VI: High
VA: Low

Description

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are performed inside arrays. Contracts placing internal calls in nested array elements, external call arguments, struct literals, or raw_log topics can have memory corrupted, producing incorrect contract behavior.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
vyperlang vyper 0.1.0b4 < 0.3.0

References & Advisories (2)

Bug Bounty Relevance

77 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

8.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.28%
Raw Score 0.002840
Percentile 21.0%
Date 2026-10-30

EPSS Trend

2026-10-30
0.00284
2026-10-29
0.00284

Intelligence Sources

mitre ref →
nvd ref →

External Links