Advisory Database
  • Advisories
  • Dependency Scanning
  1. pypi
  2. ›
  3. vyper
  4. ›
  5. CVE-2023-32058

CVE-2023-32058: Vyper vulnerable to integer overflow in loop

May 12, 2023 (updated November 19, 2024)

Due to missing overflow check for loop variables, by assigning the iterator of a loop to a variable, it is possible to overflow the type of the latter.

In the following example, calling test returns 354, meaning that the variable a did store 354 a value out of bound for the type uint8.

@external
def test() -> uint16:
x:uint8 = 255
a:uint8 = 0
for i in range(x, x+100):
a = i
return convert(a,uint16)

The issue seems to happen only in loops of type for i in range(a, a + N) as in loops of type for i in range(start, stop) and for i in range(stop), the compiler is able to raise a TypeMismatch when trying to overflow the variable.

thanks to @trocher for reporting

References

  • github.com/advisories/GHSA-6r8q-pfpv-7cgj
  • github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-78.yaml
  • github.com/vyperlang/vyper
  • github.com/vyperlang/vyper/commit/3de1415ee77a9244eb04bdb695e249d3ec9ed868
  • github.com/vyperlang/vyper/security/advisories/GHSA-6r8q-pfpv-7cgj
  • nvd.nist.gov/vuln/detail/CVE-2023-32058

Code Behaviors & Features

Detect and mitigate CVE-2023-32058 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →

Affected versions

All versions before 0.3.8

Fixed versions

  • 0.3.8

Solution

Upgrade to version 0.3.8 or above.

Impact 7.5 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Learn more about CVSS

Weakness

  • CWE-190: Integer Overflow or Wraparound

Source file

pypi/vyper/CVE-2023-32058.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sun, 08 Nov 2026 00:16:07 +0000.