PyPI/vyper CVE-2024-24563: critical 9.8, EPSS 1.54%

Vyper negative array index bounds checks

Action: Upgrade vyper to 0.4.0 or later.

pip install vyper==0.4.0

Affected

Fixed versions

Sources

• osv: GHSA-52xq-j7v9-v4v2
• https://github.com/vyperlang/vyper/security/advisories/GHSA-52xq-j7v9-v4v2
• https://nvd.nist.gov/vuln/detail/CVE-2024-24563
• https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2024-150.yaml
• https://github.com/vyperlang/vyper
• https://github.com/vyperlang/vyper/blob/a1fd228cb9936c3e4bbca6f3ee3fb4426ef45490/vyper/codegen/core.py#L534-L541
• https://github.com/vyperlang/vyper/blob/c150fc49ee9375a930d177044559b83cb95f7963/vyper/semantics/types/subscriptable.py#L127-L137

CVE-2024-24563 · published 2024-02-07T17:27:58Z · modified 2026-09-10T03:50:09.790324014Z · JSON