CVE-2022-24787

Name: CVE-2022-24787
Creator: NVD / NIST
Published: 2022-04-04T18:15:07.877+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.5/10EPSS 0.97%

Last modified Jun 17, 2026

CVE-2022-24787 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. In version 0.3.1 and prior, bytestrings can have dirty bytes in them, resulting in the word-for-word comparisons giving incorrect results. EPSS estimates a 0.97% chance of exploitation in the next 30 days.

Description

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. In version 0.3.1 and prior, bytestrings can have dirty bytes in them, resulting in the word-for-word comparisons giving incorrect results. Even without dirty nonzero bytes, two bytestrings can compare to equal if one ends with `"\x00"` because there is no comparison of the length. A patch is available and expected to be part of the 0.3.2 release. There are currently no known workarounds.

Metrics

CVSS 3.1

7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS Probability

0.97%

57.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Vyperlang	Vyper	<= 0.3.1

References

https://github.com/vyperlang/vyper/commit/2c73f8352635c0a433423a5b94740de1a118e508Patch, Third Party Advisory
https://github.com/vyperlang/vyper/security/advisories/GHSA-7vrm-3jc8-5wwmPatch, Third Party Advisory
https://github.com/vyperlang/vyper/commit/2c73f8352635c0a433423a5b94740de1a118e508Patch, Third Party Advisory
https://github.com/vyperlang/vyper/security/advisories/GHSA-7vrm-3jc8-5wwmPatch, Third Party Advisory

Timeline

Published: Apr 4, 2022
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2022-24787?

How severe is CVE-2022-24787?

CVE-2022-24787 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 0.97% probability of exploitation in the next 30 days.

How do I fix CVE-2022-24787?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-24787?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST