CVE-2023-46247

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Contracts containing large arrays might underallocate the number of slots they need by 1. Prior to v0.3.8, the calculation to determine how many slots a storage variable needed used `math.ceil(type_.size_in_bytes / 32)`. The intermediate floating point step can produce a rounding error if there are enough bits set in the IEEE-754 mantissa. Roughly speaking, if `type_.size_in_bytes` is large (> 2**46), and slightly less than a power of 2, the calculation can overestimate how many slots are needed by 1. If `type_.size_in_bytes` is slightly more than a power of 2, the calculation can underestimate how many slots are needed by 1. This issue is patched in version 0.3.8.

• CWE-193
• CWE-682

• https://github.com/vyperlang/vyper/blob/6020b8bbf66b062d299d87bc7e4eddc4c9d1c157/vyper/semantics/validation/data_positions.py#L197Product
• https://github.com/vyperlang/vyper/commit/0bb7203b584e771b23536ba065a6efda457161bbPatch
• https://github.com/vyperlang/vyper/security/advisories/GHSA-6m97-7527-mh74Third Party Advisory
• https://github.com/vyperlang/vyper/blob/6020b8bbf66b062d299d87bc7e4eddc4c9d1c157/vyper/semantics/validation/data_positions.py#L197Product
• https://github.com/vyperlang/vyper/commit/0bb7203b584e771b23536ba065a6efda457161bbPatch
• https://github.com/vyperlang/vyper/security/advisories/GHSA-6m97-7527-mh74Third Party Advisory

Published

Dec 13, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-46241`discourse-microsoft-auth` is a plugin that enables authenti…8.1
• CVE-2023-46242XWiki Platform is a generic wiki platform offering runtime s…8.8
• CVE-2023-46243XWiki Platform is a generic wiki platform offering runtime s…8.8
• CVE-2023-46244XWiki Platform is a generic wiki platform offering runtime s…8.8
• CVE-2023-46245Kimai is a web-based multi-user time-tracking application. V…7.2
• CVE-2023-46246Vim is an improved version of the good old UNIX editor Vi. H…5.5
• CVE-2023-46248Cody is an artificial intelligence (AI) coding assistant. Th…8.8
• CVE-2023-46249authentik is an open-source Identity Provider. Prior to vers…9.8
• CVE-2023-4625Improper Restriction of Excessive Authentication Attempts vu…5.3
• CVE-2023-46250pypdf is a free and open-source pure-python PDF library. An …5.5
• CVE-2023-46251 MyBB is a free and open source forum software. Custom MyCod…6.1
• CVE-2023-46252Squidex is an open source headless CMS and content managemen…6.1