UnratedFix available
VVE-2021-0001: Memory corruption using function calls within arrays
Type: advisorySources: OSV
### Impact When performing a function call inside an array, there is a memory corruption issue that occurs because of an incorrect pointer to the the tip of the stack. ### Patches This issue was partially fixed in [VVE-2020-0004](https://github.com/vyperlang/vyper/security/advisories/GHSA-2r3x-4mrv-mcxf), however the fix did not update similar code for arrays, which had a similar issue. The issue is fully fixed in https://github.com/vyperlang/vyper/pull/2345
- Products
- vyper
- Affected versions
- 0.1.0b1, 0.1.0b10, 0.1.0b11, 0.1.0b12, 0.1.0b13, 0.1.0b14, 0.1.0b15, 0.1.0b16, 0.1.0b17, 0.1.0b2, 0.1.0b3, 0.1.0b4, 0.1.0b5, 0.1.0b6, 0.1.0b7, 0.1.0b8, 0.1.0b9, 0.2.1, 0.2.10, 0.2.11, 0.2.2, 0.2.3, 0.2.4, 0.2.5, 0.2.6, 0.2.7, 0.2.8, 0.2.9
- Fixed versions
- 0.2.12
- CVEs
- CVE-2021-48020
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 03:39 UTC · Revision 1
Source evidence
VVE-2021-0001: Memory corruption using function calls within arrays
core-osv · Original sourcePublished 19 Apr 2021, 15:12 UTC
### Impact When performing a function call inside an array, there is a memory corruption issue that occurs because of an incorrect pointer to the the tip of the stack. ### Patches This issue was partially fixed in [VVE-2020-0004](https://github.com/vyperlang/vyper/security/advisories/GHSA-2r3x-4mrv-mcxf), however the fix did not update similar code for arrays, which had a similar issue. The issue is fully fixed in https://github.com/vyperlang/vyper/pull/2345
osv:GHSA-22wc-c9wj-6q2v
vyper
Fixed versions: 0.2.12
Complete source record
{
"id": "448e2993efa45a5f441b7e18aed56af41810aeb1976d395b0773e879ccae6bb7",
"url": "https://osv.dev/vulnerability/GHSA-22wc-c9wj-6q2v",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "VVE-2021-0001: Memory corruption using function calls within arrays",
"summary": "### Impact When performing a function call inside an array, there is a memory corruption issue that occurs because of an incorrect pointer to the the tip of the stack. ### Patches This issue was partially fixed in [VVE-2020-0004](https://github.com/vyperlang/vyper/security/advisories/GHSA-2r3x-4mrv-mcxf), however the fix did not update similar code for arrays, which had a similar issue. The issue is fully fixed in https://github.com/vyperlang/vyper/pull/2345",
"evidence": "osv:GHSA-22wc-c9wj-6q2v",
"products": [
{
"name": {
"value": "vyper",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.2.12",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "0.1.0b1",
"evidence": "/affected/0/versions"
},
{
"value": "0.1.0b10",
"evidence": "/affected/0/versions"
},
{
"value": "0.1.0b11",
"evidence": "/affected/0/versions"
},
{
"value": "0.1.0b12",
"evidence": "/affected/0/versions"
},
{
"value": "0.1.0b13",
"evidence": "/affected/0/versions"
},
{
"value": "0.1.0b14",
"evidence": "/affected/0/versions"
},
{
"value": "0.1.0b15",
"evidence": "/affected/0/versions"
},
{
"value": "0.1.0b16",
"evidence": "/affected/0/versions"
},
{
"value": "0.1.0b17",
"evidence": "/affected/0/versions"
},
{
"value": "0.1.0b2",
"evidence": "/affected/0/versions"
},
{
"value": "0.1.0b3",
"evidence": "/affected/0/versions"
},
{
"value": "0.1.0b4",
"evidence": "/affected/0/versions"
},
{
"value": "0.1.0b5",
"evidence": "/affected/0/versions"
},
{
"value": "0.1.0b6",
"evidence": "/affected/0/versions"
},
{
"value": "0.1.0b7",
"evidence": "/affected/0/versions"
},
{
"value": "0.1.0b8",
"evidence": "/affected/0/versions"
},
{
"value": "0.1.0b9",
"evidence": "/affected/0/versions"
},
{
"value": "0.2.1",
"evidence": "/affected/0/versions"
},
{
"value": "0.2.10",
"evidence": "/affected/0/versions"
},
{
"value": "0.2.11",
"evidence": "/affected/0/versions"
},
{
"value": "0.2.2",
"evidence": "/affected/0/versions"
},
{
"value": "0.2.3",
"evidence": "/affected/0/versions"
},
{
"value": "0.2.4",
"evidence": "/affected/0/versions"
},
{
"value": "0.2.5",
"evidence": "/affected/0/versions"
},
{
"value": "0.2.6",
"evidence": "/affected/0/versions"
},
{
"value": "0.2.7",
"evidence": "/affected/0/versions"
},
{
"value": "0.2.8",
"evidence": "/affected/0/versions"
},
{
"value": "0.2.9",
"evidence": "/affected/0/versions"
}
]
}
],
"severity": "unknown",
"structured": {
"id": "GHSA-22wc-c9wj-6q2v",
"aliases": [
"CVE-2021-48020",
"GHSA-22wc-c9wj-6q2v"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.2.12"
}
]
}
],
"package": {
"name": "vyper",
"purl": "pkg:pypi/vyper",
"ecosystem": "PyPI"
},
"versions": [
"0.1.0b1",
"0.1.0b10",
"0.1.0b11",
"0.1.0b12",
"0.1.0b13",
"0.1.0b14",
"0.1.0b15",
"0.1.0b16",
"0.1.0b17",
"0.1.0b2",
"0.1.0b3",
"0.1.0b4",
"0.1.0b5",
"0.1.0b6",
"0.1.0b7",
"0.1.0b8",
"0.1.0b9",
"0.2.1",
"0.2.10",
"0.2.11",
"0.2.2",
"0.2.3",
"0.2.4",
"0.2.5",
"0.2.6",
"0.2.7",
"0.2.8",
"0.2.9"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-22wc-c9wj-6q2v/GHSA-22wc-c9wj-6q2v.json"
}
}
],
"modified": "2026-10-24T02:56:12.315912230Z",
"provider": "osv",
"references": [
"https://github.com/vyperlang/vyper/security/advisories/GHSA-22wc-c9wj-6q2v",
"https://github.com/vyperlang/vyper/pull/2345",
"https://github.com/vyperlang/vyper/commit/11b7b5b7e59bc9dc859d51cd41a924b59fe47c9e",
"https://pypi.org/project/vyper"
],
"provider_metadata": {
"cwe_ids": [
"CWE-129"
],
"severity": "MODERATE",
"github_reviewed": true,
"nvd_published_at": null,
"github_reviewed_at": "2021-04-16T23:11:53Z"
}
},
"related_cves": [
{
"value": "CVE-2021-48020",
"evidence": "/aliases"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 428183,
"published_at": "2021-04-19T15:12:05+00:00"
}