Skip to content
Heist/ feed
Back to feed
Medium

Security advisory

Type: advisorySources: OSVCVE: CVE-2020-37288

Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination (stack underflow). Affected contracts revert such calls unnecessarily, which in limited circumstances could enable denial of service against public contracts.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2020-37288
Confirmed fixed CVEs
Not specified
Updated in this feed
1 Nov 2026, 03:38 UTC · Revision 1

Source evidence

CVE-2020-37288

core-osv · Original source

Published 21 Oct 2026, 01:17 UTC

Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination (stack underflow). Affected contracts revert such calls unnecessarily, which in limited circumstances could enable denial of service against public contracts.

osv:CVE-2020-37288
Complete source record
{
  "id": "e367d0359bca2d577a5202545e173ec2c4fbe33855a20dc90db5d1c231695834",
  "url": "https://osv.dev/vulnerability/CVE-2020-37288",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2020-37288",
    "summary": "Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination (stack underflow). Affected contracts revert such calls unnecessarily, which in limited circumstances could enable denial of service against public contracts.",
    "evidence": "osv:CVE-2020-37288",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2020-37288",
      "aliases": [
        "CVE-2020-37288",
        "GHSA-vg88-3v92-rjx2"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/vyperlang/vyper",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "006968f021b0b0001c0d4fa9465160f1dbfbc453"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0.1.0b10"
                      },
                      {
                        "fixed": "0.2.3"
                      }
                    ],
                    "source": "DESCRIPTION"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v0.2.2",
            "v0.2.1",
            "0.2.1",
            "v0.2.0",
            "v0.1.0-beta.17",
            "v0.1.0-beta.16",
            "v0.1.0-beta.15",
            "v0.1.0-beta.14",
            "v0.1.0-beta.13",
            "v0.1.0-beta.12",
            "v0.1.0-beta.11",
            "v0.1.0-beta.10",
            "v0.1.0-beta.9",
            "v0.1.0-beta.8",
            "v0.1.0-beta.7",
            "v0.1.0-beta.6",
            "v0.1.0-beta.5",
            "v0.1.0-beta.3",
            "v0.1.0-beta.2",
            "v0.1.0-beta.1",
            "v0.0.4"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-37288.json"
          }
        }
      ],
      "modified": "2026-10-24T02:45:09.587843433Z",
      "provider": "osv",
      "references": [
        "https://github.com/vyperlang/vyper/security/advisories/GHSA-vg88-3v92-rjx2",
        "https://www.vulncheck.com/advisories/vyper-0.1-0b10-before-0.2.3-invalid-jump-destination-via-return-in-nested-loops"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2020-37288",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 428161,
  "published_at": "2026-10-21T01:17:18.683+00:00"
}