Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.3

Vyper 0.2.8 proxies cut off data over 4096 bytes

CVE-2021-48019 · published 15 days ago
Summary

Versions of Vyper before 0.2.9 create special proxy contracts that always claim a return size of 4,096 bytes, even when the actual response is larger. If a program calls a function that returns more than that amount, the data can become corrupted or cause the call to fail, affecting operations like token transfers. Upgrade Vyper to version 0.2.9 or later, or replace the proxy usage with a safe alternative.

What to do
  • Update vyper to version 0.2.9.
  • Update vyperlang vyper to version 0.2.9 or later.
Affected software
Ecosystem VendorProductAffected versions
– vyperlang vyper < 0.2.9
PyPI – vyper < 0.2.9
Fix: upgrade to 0.2.9
Original advisory text
Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies
Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data when a function returns more than 4096 bytes without return data sanitation, and fail strict return-size checks such as SafeERC20.safeTransfer.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-805Buffer Access with Incorrect Length Value
CWE-20Improper Input Validation
Timeline
Published21 Oct 2026
Updated4 Nov 2026
First seen21 Oct 2026
Sources
CVE-2021-48019 · NVD
CVE-2021-48019 · MITRE
GHSA-375m-5fvv-xq23 · OSV
Track software like this
Free during beta