Advisory Database
  • Advisories
  • Dependency Scanning
  1. pypi
  2. ›
  3. vyper
  4. ›
  5. CVE-2024-26149

CVE-2024-26149: Vyper's `_abi_decode` vulnerable to Memory Overflow

February 26, 2024 (updated January 17, 2025)

If an excessively large value is specified as the starting index for an array in _abi_decode, it can cause the read position to overflow. This results in the decoding of values outside the intended array bounds, potentially leading to bugs in contracts that use arrays within _abi_decode. The advisory has been assigned low severity, because it is only observable if there is a memory write between two invocations of abi_decode on the same input.

References

  • github.com/advisories/GHSA-9p8r-4xp4-gw5w
  • github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2024-164.yaml
  • github.com/vyperlang/vyper
  • github.com/vyperlang/vyper/pull/3925
  • github.com/vyperlang/vyper/pull/4060
  • github.com/vyperlang/vyper/pull/4091
  • github.com/vyperlang/vyper/pull/4144
  • github.com/vyperlang/vyper/security/advisories/GHSA-9p8r-4xp4-gw5w
  • nvd.nist.gov/vuln/detail/CVE-2024-26149

Code Behaviors & Features

Detect and mitigate CVE-2024-26149 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →

Affected versions

All versions before 0.4.0

Fixed versions

  • 0.4.0

Solution

Upgrade to version 0.4.0 or above.

Impact 3.7 LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Learn more about CVSS

Weakness

  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
  • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Source file

pypi/vyper/CVE-2024-26149.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sun, 08 Nov 2026 00:16:24 +0000.