CVE Feed

    Dashboard / CVE / CVE-2021-48018

    CVE-2021-48018

    Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variables. When a function using @nonreentrant is called, setting the lock overwrites the overlapping storage variable, corrupting contract state and breaking the contract's intended logic.

    Published:Oct 21, 2026
    Last Modified:Oct 23, 2026
    EPS:Oct 21, 2026
    EPSS Score:0.00321
    CVSS Score:7.4

    Affected Products

    Vendor
    Vyperlang
    Product
    Vyper

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-787 Out-of-bounds Write

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-114663 (CVSS 8.6) — Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported mod…
    CVE-2026-114118 (CVSS 6.3) — Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by uint256 subtract…
    CVE-2026-114117 (CVSS 8.2) — Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | …
    CVE-2026-114116 (CVSS 6) — Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), wh…
    CVE-2026-114115 (CVSS 6.3) — Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that reads nested …
    CVE-2026-114114 (CVSS 6) — Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Pytho…
    CVE-2021-48020 (CVSS 8.3) — Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip po…
    CVE-2021-48019 (CVSS 6.3) — Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a f…
    CVE-2020-37289 (CVSS 6.3) — Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decim…
    CVE-2020-37288 (CVSS 6.3) — Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an inter…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High