CVE-2023-30837 HIGH

CVE-2023-30837: Vyper storage allocator overflow

Vendor Vyperlang

Product vyper

Weakness CWE-789

Published May 8, 2023

Last update January 29, 2025

View on NVD All CVEs

CVSS base score

7.5/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality None

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

What the vulnerability does

01Description

Vyper is a pythonic smart contract language for the EVM. The storage allocator does not guard against allocation overflows in versions prior to 0.3.8. An attacker can overwrite the owner variable. This issue was fixed in version 0.3.8.

Key dates

02Disclosure timeline

May 8, 2023 CVE published

January 29, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-30837 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/789.html

Related vulnerabilities

04Related CVE

CVE-2026-40891 OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handling CVE-2022-22226 Junos OS: EX4300-MP, EX4600, QFX5000 Series: In VxLAN scenarios specific packets processed cause a memory leak leading to a PFE crash CVE-2026-2456 Denial of Service via Unbounded Memory Allocation in Integration Actions CVE-2022-34917 Unauthenticated clients may cause OutOfMemoryError on Apache Kafka Brokers CVE-2024-41132 SixLabors ImageSharp Allows Excessive Memory Allocation in Gif Decoder