CVE-2024-32645 json
vyper performs incorrect topic logging in raw_log
published 2024-04-25 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-0182 , GHSA-xchq-w5r3-4wg3 , PYSEC-2024-206
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 39%
- public exploits
- 0
- none known
Summary
Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, incorrect values can be logged when `raw_log` builtin is called with memory or storage arguments to be used as topics. A contract search was performed and no vulnerable contracts were found in production. The `build_IR` function of the `RawLog` class fails to properly unwrap the variables provided as topics. Consequently, incorrect values are logged as topics. As of time of publication, no fixed version is available.
Patch / fix
- pypi vyper 0.4.0
- vyperlang vyper 0.4.0
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.45% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| OSV | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | vyper | <0.4.0 |
0.4.0 |
Affected products
- vyperlang vyper
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
github.com
/vyperlang/vyper/security/advisories/GHSA-xchq-w5r3-4wg3
web, vendor-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-32645
advisory
-
github.com
/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2024-206.yaml
web
-
github.com
/vyperlang/vyper
package
-
github.com
/advisories/GHSA-xchq-w5r3-4wg3
advisory
Sources
- CVE List CVE-2024-32645
- GitHub Advisory GHSA-xchq-w5r3-4wg3
- NVD CVE-2024-32645
- OSV PYSEC-2024-206
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.