{"id":"CVE-2021-48020","kind":"vulnerability","aliases":["CVE-2021-48020"],"related":[],"title":"Vyper: stack pointer bug corrupts memory during internal calls in arrays","description":"Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are performed inside arrays. Contracts placing internal calls in nested array elements, external call arguments, struct literals, or raw_log topics can have memory corrupted, producing incorrect contract behavior.","summary":"Vyper compiler versions from 0.1.0b4 before 0.3.0 generate incorrect stack tip handling when internal function calls appear inside arrays, external call arguments, struct literals, or raw_log topics. The result is memory corruption that makes deployed smart contracts behave incorrectly.","severity":"high","cvss":8.3,"epss":0.00284,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ethereum","package","smart-contracts","vyper"],"not_affected_if":["no-internal-calls-in-arrays","vyper-0.3.0-or-later"],"how_to_check":"- `vyper --version` on the build machine, or the `vyper` version pinned in the project's requirements or lockfile\n- Search the project for Vyper contracts that place internal calls inside array literals, external call arguments, struct literals, or `raw_log` topics","fix":"- Upgrade Vyper to `0.3.0` or later\n- Recompile and redeploy affected contracts, then re-test their behaviour","status":"open","published_at":"2026-10-21T01:17:19+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T03:02:18+00:00","updated_at":"2026-10-25T03:02:18+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:02:18Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Vyper to `0.3.0` or later\n- Recompile and redeploy affected contracts, then re-test their behaviour","reach":"unknown","title":"Vyper: stack pointer bug corrupts memory during internal calls in arrays","impact":"high","summary":"Vyper compiler versions from 0.1.0b4 before 0.3.0 generate incorrect stack tip handling when internal function calls appear inside arrays, external call arguments, struct literals, or raw_log topics. The result is memory corruption that makes deployed smart contracts behave incorrectly.","category":"package","nicknames":[],"who_cares":["vyper","smart-contracts","ethereum"],"confidence":0.7,"needs_auth":"no","worst_case":"deployed contracts behave incorrectly because memory is corrupted","analyst_note":"","how_to_check":"- `vyper --version` on the build machine, or the `vyper` version pinned in the project's requirements or lockfile\n- Search the project for Vyper contracts that place internal calls inside array literals, external call arguments, struct literals, or `raw_log` topics","needs_analyst":false,"not_affected_if":["vyper-0.3.0-or-later","no-internal-calls-in-arrays"],"who_is_affected":"Teams that compiled Vyper contracts with a compiler from 0.1.0b4 up to but not including 0.3.0 are exposed, and only when the contract code uses internal calls in one of the listed constructs. Projects that never used the affected Vyper versions or those constructs can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000625,"input_tokens":3391,"output_tokens":572,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2021':13A,16A '-48020':14A,17A '0.1.0':28B,67C '0.3.0':31B,70C 'appear':41B 'argument':46B,101C 'array':11A,43B,90C,97C 'b4':29B,68C 'behav':63B 'behavior':115C 'bug':4A 'call':9A,40B,45B,86C,94C,100C 'caus':76C 'compil':25B 'contain':71C 'contract':22B,62B,91C,114C 'corrupt':5A,57B,74C,111C 'cve':12A,15A 'deploy':60B 'element':98C 'ethereum':18B 'extern':44B,99C 'function':39B,85C 'generat':32B 'handl':36B 'incorrect':33B,64B,79C,113C 'insid':42B,89C 'intern':8A,38B,84C,93C 'liter':48B,103C 'log':51B,106C 'make':59B 'memori':6A,56B,73C,110C 'nest':96C 'packag':19B 'perform':88C 'place':92C 'pointer':3A,82C 'produc':112C 'raw':50B,105C 'result':54B 'smart':21B,61B 'smart-contract':20B 'stack':2A,34B,80C 'struct':47B,102C 'tip':35B,81C 'topic':52B,107C 'version':26B 'vulner':75C 'vyper':1A,23B,24B,65C","nicknames":[],"mitigations":[],"who_affected":"Teams that compiled Vyper contracts with a compiler from 0.1.0b4 up to but not including 0.3.0 are exposed, and only when the contract code uses internal calls in one of the listed constructs. Projects that never used the affected Vyper versions or those constructs can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2021-48020","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-48020","severity":null,"published_at":"2026-10-21T01:17:19+00:00","modified_at":"2026-10-22T17:00:33+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2021-48020","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-48020","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}