CVE-2024-26149

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. If an excessively large value is specified as the starting index for an array in `_abi_decode`, it can cause the read position to overflow. This results in the decoding of values outside the intended array bounds, potentially leading to exploitations in contracts that use arrays within `_abi_decode`. This vulnerability affects 0.3.10 and earlier versions.

• CWE-119

• https://github.com/vyperlang/vyper/security/advisories/GHSA-9p8r-4xp4-gw5wExploit, Patch, Vendor Advisory
• https://github.com/vyperlang/vyper/security/advisories/GHSA-9p8r-4xp4-gw5wExploit, Patch, Vendor Advisory

Published

Feb 26, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-26143Rails is a web-application framework. There is a possible XS…6.1
• CVE-2024-26144Rails is a web-application framework. Starting with version …5.3
• CVE-2024-26145Discourse Calendar adds the ability to create a dynamic cale…4.3
• CVE-2024-26146Rack is a modular Ruby web server interface. Carefully craft…7.5
• CVE-2024-26147Helm is a package manager for Charts for Kubernetes. Version…7.5
• CVE-2024-26148Querybook is a user interface for querying big data. Prior t…6.1
• CVE-2024-2615Memory safety bugs present in Firefox 123. Some of these bug…9.8
• CVE-2024-26150`@backstage/backend-common` is a common functionality librar…7.5
• CVE-2024-26151The `mjml` PyPI package, found at the `FelixSchwarz/mjml-pyt…5.4
• CVE-2024-26152### Summary On all Label Studio versions prior to 1.11.0, da…6.1
• CVE-2024-26153All versions of ETIC Telecom Remote Access Server (RAS) prio…7.4
• CVE-2024-26154All versions of ETIC Telecom Remote Access Server (RAS) prio…6.1