CVE-2023-37902 json
Vyper's ecrecover can return undefined data if signature does not verify
published 2023-07-25 3 y ago modified 2026-06-17 4 mo ago also GHSA-f5x6-7qgp-jhf3 , PYSEC-2023-133 , EUVD-2023-0264
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 47%
- public exploits
- 0
- none known
Summary
Vyper is a Pythonic programming language that targets the Ethereum Virtual Machine (EVM). Prior to version 0.3.10, the ecrecover precompile does not fill the output buffer if the signature does not verify. However, the ecrecover builtin will still return whatever is at memory location 0. This means that the if the compiler has been convinced to write to the 0 memory location with specially crafted data (generally, this can happen with a hashmap access or immutable read) just before the ecrecover, a signature check might pass on an invalid signature. Version 0.3.10 contains a patch for this issue.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.57% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/vyperlang/vyper/security/advisories/GHSA-f5x6-7qgp-jhf3 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| OSV | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | vyper | <0.3.10 <0.3.9 |
0.3.10 0.3.9 |
Affected products
- vyperlang vyper
Classification
- Weakness
-
- CWE-252 Unchecked Return Value
References
-
github.com
/vyperlang/vyper/commit/019a37ab98ff53f04fecfadf602b6cd5ac748f7f
web, patch
-
github.com
/vyperlang/vyper/security/advisories/GHSA-f5x6-7qgp-jhf3
web, exploit, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-37902
advisory
-
github.com
/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-133.yaml
web
-
github.com
/vyperlang/vyper
package
Sources
- CVE List CVE-2023-37902
- GitHub Advisory GHSA-f5x6-7qgp-jhf3
- NVD CVE-2023-37902
- OSV PYSEC-2023-133
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.