CVE-2023-42443

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In version 0.3.9 and prior, under certain conditions, the memory used by the builtins `raw_call`, `create_from_blueprint` and `create_copy_of` can be corrupted. For `raw_call`, the argument buffer of the call can be corrupted, leading to incorrect `calldata` in the sub-context. For `create_from_blueprint` and `create_copy_of`, the buffer for the to-be-deployed bytecode can be corrupted, leading to deploying incorrect bytecode. Each builtin has conditions that must be fulfilled for the corruption to happen. For `raw_call`, the `data` argument of the builtin must be `msg.data` and the `value` or `gas` passed to the builtin must be some complex expression that results in writing to the memory. For `create_copy_of`, the `value` or `salt` passed to the builtin must be some complex expression that results in writing to the memory. For `create_from_blueprint`, either no constructor parameters should be passed to the builtin or `raw_args` should be set to True, and the `value` or `salt` passed to the builtin must be some complex expression that results in writing to the memory. As of time of publication, no patched version exists. The issue is still being investigated, and there might be other cases where the corruption might happen. When the builtin is being called from an `internal` function `F`, the issue is not present provided that the function calling `F` wrote to memory before calling `F`. As a workaround, the complex expressions that are being passed as kwargs to the builtin should be cached in memory prior to the call to the builtin.

• CWE-787

• https://github.com/vyperlang/vyper/issues/3609Issue Tracking, Vendor Advisory
• https://github.com/vyperlang/vyper/security/advisories/GHSA-c647-pxm2-c52wExploit, Patch, Vendor Advisory
• https://github.com/vyperlang/vyper/issues/3609Issue Tracking, Vendor Advisory
• https://github.com/vyperlang/vyper/security/advisories/GHSA-c647-pxm2-c52wExploit, Patch, Vendor Advisory

Published

Sep 18, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-42437Rejected reason: This is unused.
• CVE-2023-42438An inconsistent user interface issue was addressed with impr…4.3
• CVE-2023-42439GeoNode is an open source platform that facilitates the crea…6.5
• CVE-2023-4244A use-after-free vulnerability in the Linux kernel's netfilt…7
• CVE-2023-42441Vyper is a Pythonic Smart Contract Language for the Ethereum…5.3
• CVE-2023-42442JumpServer is an open source bastion host and a professional…5.3
• CVE-2023-42444phonenumber is a library for parsing, formatting and validat…7.5
• CVE-2023-42445Gradle is a build tool with a focus on build automation and …5.3
• CVE-2023-42446Pow is a authentication and user management solution for Pho…6.5
• CVE-2023-42447blurhash-rs is a pure Rust implementation of Blurhash, softw…7.5
• CVE-2023-42448Hydra is the layer-two scalability solution for Cardano. Pri…8.1
• CVE-2023-42449Hydra is the two-layer scalability solution for Cardano. Pri…8.1