{"id":"CVE-2020-37286","kind":"vulnerability","aliases":["CVE-2020-37286"],"related":[],"title":"Vyper compiler: stack pointer bug corrupts memory in nested internal calls","description":"Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested calls. Contracts using such calls as tuple elements, call arguments, or builtin arguments like concat or ecrecover can return corrupted values or pass wrong arguments to external calls.","summary":"Vyper versions from 0.1.0b4 before 0.3.0 generate incorrect stack handling when internal function calls appear inside tuples or nested calls. Affected smart contracts can return corrupted values or pass wrong arguments to external calls.","severity":"high","cvss":8.3,"epss":0.00284,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ethereum","package","python","smart-contracts","vyper"],"not_affected_if":["no-vyper-contracts","vyper-0.3.0-or-later"],"how_to_check":"- Run `vyper --version` in the build environment and check whether it reports a version below `0.3.0`.\n- Search the project's dependency lock files for `vyper` pinned below `0.3.0`.\n- Look for contracts that call internal functions inside tuple returns, call arguments, or builtins such as `concat` or `ecrecover`.","fix":"- Upgrade the Vyper compiler to `0.3.0` or later.\n- Recompile and redeploy affected contracts, then re-run their tests.","status":"open","published_at":"2026-10-21T01:17:18+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T03:02:19+00:00","updated_at":"2026-10-25T03:02:19+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:02:19Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Vyper compiler to `0.3.0` or later.\n- Recompile and redeploy affected contracts, then re-run their tests.","reach":"unknown","title":"Vyper compiler: stack pointer bug corrupts memory in nested internal calls","impact":"high","summary":"Vyper versions from 0.1.0b4 before 0.3.0 generate incorrect stack handling when internal function calls appear inside tuples or nested calls. Affected smart contracts can return corrupted values or pass wrong arguments to external calls.","category":"package","nicknames":[],"who_cares":["vyper","smart-contracts","ethereum","python"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Contracts return corrupted values or send wrong arguments externally.","analyst_note":"","how_to_check":"- Run `vyper --version` in the build environment and check whether it reports a version below `0.3.0`.\n- Search the project's dependency lock files for `vyper` pinned below `0.3.0`.\n- Look for contracts that call internal functions inside tuple returns, call arguments, or builtins such as `concat` or `ecrecover`.","needs_analyst":false,"not_affected_if":["vyper-0.3.0-or-later","no-vyper-contracts"],"who_is_affected":"Teams that compile Vyper smart contracts with a compiler older than 0.3.0. Exposure depends on whether the contract code uses internal calls nested inside tuples, call arguments, or builtin arguments. Teams not using Vyper, or already on 0.3.0 or later, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000636,"input_tokens":3396,"output_tokens":592,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2020':13A,16A '-37286':14A,17A '0.1.0':28B,62C '0.3.0':31B,65C 'affect':46B 'appear':40B,82C 'argument':56B,96C,99C,111C 'b4':29B,63C 'bug':5A 'builtin':98C 'call':11A,39B,45B,59B,81C,87C,91C,95C,114C 'caus':71C 'compil':2A 'concat':101C 'contain':66C 'contract':23B,48B,88C 'corrupt':6A,51B,69C,106C 'cve':12A,15A 'ecrecov':103C 'element':94C 'ethereum':18B 'extern':58B,113C 'function':38B,80C 'generat':32B 'handl':35B 'incorrect':33B,74C 'insid':41B,83C 'intern':10A,37B,79C 'like':100C 'memori':7A,68C 'nest':9A,44B,86C 'packag':19B 'pass':54B,109C 'pointer':4A,77C 'python':20B 'return':50B,105C 'smart':22B,47B 'smart-contract':21B 'stack':3A,34B,75C 'tip':76C 'tupl':42B,84C,93C 'use':89C 'valu':52B,107C 'version':26B 'vulner':70C 'vyper':1A,24B,25B,60C 'wrong':55B,110C","nicknames":[],"mitigations":[],"who_affected":"Teams that compile Vyper smart contracts with a compiler older than 0.3.0. Exposure depends on whether the contract code uses internal calls nested inside tuples, call arguments, or builtin arguments. Teams not using Vyper, or already on 0.3.0 or later, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2020-37286","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-37286","severity":null,"published_at":"2026-10-21T01:17:18+00:00","modified_at":"2026-10-22T17:00:33+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2020-37286","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-37286","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}