Low severity · published Oct 21, 2026
CVE-2020-37288
Vyper 0.1.0b10 before 0.2.3 Invalid Jump Destination via Return in Nested Loops
3.7
CVSS
0.3%
EPSS
No
On KEV
Description
Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination (stack underflow). Affected contracts revert such calls unnecessarily, which in limited circumstances could enable denial of service against public contracts.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VY
vyper · vyperlang
0.1.0b10 before 0.2.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-37288
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-37288
github.com
https://github.com/vyperlang/vyper/security/advisories/GHSA-vg88-3v92-rjx2
www.vulncheck.com
https://www.vulncheck.com/advisories/vyper-0.1-0b10-before-0.2.3-invalid-jump-destination-via-return-in-nested-loops
More from vyper
9.8
CVE-2024-24563
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine
9.8
CVE-2024-24561
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine
9.8
CVE-2024-22419
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine
9.8
CVE-2022-24845
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine
9.8
CVE-2022-24788
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine
