Vyper up to 0.4.2rc1 slice insufficient control flow management

Summaryinfo

A vulnerability classified as problematic was found in Vyper up to 0.4.2rc1. The affected element is the function slice. Executing a manipulation can lead to insufficient control flow management. This vulnerability is handled as CVE-2025-47774. The attack can be executed remotely. There is not any exploit available. A patch should be applied to remediate this issue.

Detailsinfo

A vulnerability classified as problematic was found in Vyper up to 0.4.2rc1. This vulnerability affects the function slice. The manipulation with an unknown input leads to a insufficient control flow management vulnerability. The CWE definition for the vulnerability is CWE-691. The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways. As an impact it is known to affect integrity. CVE summarizes:

Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, the `slice()` builtin can elide side effects when the output length is 0, and the source bytestring is a builtin (`msg.data` or `.code`). The reason is that for these source locations, the check that `length >= 1` is skipped. The result is that a 0-length bytestring constructed with slice can be passed to `make_byte_array_copier`, which elides evaluation of its source argument when the max length is 0. The impact is that side effects in the `start` argument may be elided when the `length` argument is 0, e.g. `slice(msg.data, self.do_side_effect(), 0)`. The fix in pull request 4645 disallows any invocation of `slice()` with length 0, including for the ad hoc locations discussed in this advisory. The fix is expected to be part of version 0.4.2.

The advisory is available at github.com. This vulnerability was named CVE-2025-47774 since 05/09/2025. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• Vyper

Version

• 0.4.2rc1

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion