CVE-2023-31146

Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, during codegen, the length word of a dynarray is written before the data, which can result in out-of-bounds array access in the case where the dynarray is on both the lhs and rhs of an assignment. The issue can cause data corruption across call frames. The expected behavior is to revert due to out-of-bounds array access. Version 0.3.8 contains a patch for this issue.

• CWE-787
• CWE-787

• https://github.com/vyperlang/vyper/commit/4f8289a81206f767df1900ac48f485d90fc87edbPatch
• https://github.com/vyperlang/vyper/security/advisories/GHSA-3p37-3636-q8wvExploit, Vendor Advisory
• https://github.com/vyperlang/vyper/commit/4f8289a81206f767df1900ac48f485d90fc87edbPatch
• https://github.com/vyperlang/vyper/security/advisories/GHSA-3p37-3636-q8wvExploit, Vendor Advisory

Published

May 11, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-31140OpenProject is open source project management software. Star…6.5
• CVE-2023-31141OpenSearch is open-source software suite for search, analyti…5.9
• CVE-2023-31142Discourse is an open source discussion platform. Prior to ve…5.3
• CVE-2023-31143mage-ai is an open-source data pipeline tool for transformin…9.8
• CVE-2023-31144Craft CMS is a content management system. Starting in versio…6.1
• CVE-2023-31145Collabora Online is a collaborative online office suite base…6.1
• CVE-2023-31147c-ares is an asynchronous resolver library. When /dev/urando…6.5
• CVE-2023-31148An Improper Input Validation vulnerability in the Schweitz…8.8
• CVE-2023-31149 An Improper Input Validation vulnerability in the Schweit…8.8
• CVE-2023-3115An issue has been discovered in GitLab EE affecting all vers…4.3
• CVE-2023-31150 A Storing Passwords in a Recoverable Format vulnerability i…6.5
• CVE-2023-31151An Improper Certificate Validation vulnerability in the Sc…4.2