CVE-2024-24561

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.10 and earlier, the bounds check for slices does not account for the ability for start + length to overflow when the values aren't literals. If a slice() function uses a non-literal argument for the start or length variable, this creates the ability for an attacker to overflow the bounds check. This issue can be used to do OOB access to storage, memory or calldata addresses. It can also be used to corrupt the length slot of the respective array.

• CWE-119
• CWE-787

• https://github.com/vyperlang/vyper/blob/b01cd686aa567b32498fefd76bd96b0597c6f099/vyper/builtins/functions.py#L404-L457Product
• https://github.com/vyperlang/vyper/issues/3756Issue Tracking
• https://github.com/vyperlang/vyper/security/advisories/GHSA-9x7f-gwxq-6f2cExploit, Vendor Advisory
• https://github.com/vyperlang/vyper/blob/b01cd686aa567b32498fefd76bd96b0597c6f099/vyper/builtins/functions.py#L404-L457Product
• https://github.com/vyperlang/vyper/issues/3756Issue Tracking
• https://github.com/vyperlang/vyper/security/advisories/GHSA-9x7f-gwxq-6f2cExploit, Vendor Advisory

Published

Feb 1, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-24556urql is a GraphQL client that exposes a set of helpers for s…6.1
• CVE-2024-24557Moby is an open-source project created by Docker to enable s…7.8
• CVE-2024-24558TanStack Query supplies asynchronous state management, serve…6.1
• CVE-2024-24559Vyper is a Pythonic Smart Contract Language for the EVM. The…5.3
• CVE-2024-2456The Ecwid Ecommerce Shopping Cart plugin for WordPress is vu…6.4
• CVE-2024-24560Vyper is a Pythonic Smart Contract Language for the Ethereum…5.3
• CVE-2024-24562vantage6-UI is the official user interface for the vantage6 …5.3
• CVE-2024-24563Vyper is a Pythonic Smart Contract Language for the Ethereum…9.8
• CVE-2024-24564Vyper is a pythonic Smart Contract Language for the ethereum…5.3
• CVE-2024-24565CrateDB is a distributed SQL database that makes it simple t…6.5
• CVE-2024-24566Lobe Chat is a chatbot framework that supports speech synthe…5.3
• CVE-2024-24567Vyper is a pythonic Smart Contract Language for the ethereum…5.3