CVE-2023-41052

Vyper is a Pythonic Smart Contract Language. In affected versions the order of evaluation of the arguments of the builtin functions `uint256_addmod`, `uint256_mulmod`, `ecadd` and `ecmul` does not follow source order. This behaviour is problematic when the evaluation of one of the arguments produces side effects that other arguments depend on. A patch is currently being developed on pull request #3583. When using builtins from the list above, users should make sure that the arguments of the expression do not produce side effects or, if one does, that no other argument is dependent on those side effects.

• CWE-670
• CWE-670

• https://github.com/vyperlang/vyper/pull/3583Patch
• https://github.com/vyperlang/vyper/security/advisories/GHSA-4hg4-9mf5-wxxqExploit, Patch, Third Party Advisory
• https://github.com/vyperlang/vyper/pull/3583Patch
• https://github.com/vyperlang/vyper/security/advisories/GHSA-4hg4-9mf5-wxxqExploit, Patch, Third Party Advisory

Published

Sep 4, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-41047OctoPrint is a web interface for 3D printers. OctoPrint vers…6.5
• CVE-2023-41048plone.namedfile allows users to handle `File` and `Image` fi…5.4
• CVE-2023-41049@dcl/single-sign-on-client is an open source npm library whi…6.1
• CVE-2023-4105Mattermost fails to delete the attachments when deleting a m…4.3
• CVE-2023-41050AccessControl provides a general security framework for use …7.7
• CVE-2023-41051In a typical Virtual Machine Monitor (VMM) there are several…4.7
• CVE-2023-41053Redis is an in-memory database that persists on disk. Redis …3.3
• CVE-2023-41054LibreY is a fork of LibreX, a framework-less and javascript-…9.1
• CVE-2023-41055LibreY is a fork of LibreX, a framework-less and javascript-…7.5
• CVE-2023-41056Redis is an in-memory database that persists on disk. Redis …8.1
• CVE-2023-41057hyper-bump-it is a command line tool for updating the versio…5.5
• CVE-2023-41058Parse Server is an open source backend server. In affected v…7.5