{"action":"Upgrade vyper to 0.4.0 or later.","affected":[{"fixed":"0.4.0","introduced":"0"}],"component":"vyper","cve_ids":["CVE-2024-24564"],"ecosystem":"PyPI","epss":0.00565,"exploited":false,"fixed_versions":["0.4.0"],"ghsa_id":"GHSA-4hwq-4cpm-8vmx","id":"tcs_01M5KGMFAXHDY211JFZ1H42DVZ","modified_at":"2026-06-10T17:14:16.567026987Z","published_at":"2024-02-26T20:19:05Z","references":["https://osv.dev/vulnerability/PYSEC-2024-205","https://github.com/vyperlang/vyper/security/advisories/GHSA-4hwq-4cpm-8vmx","https://github.com/vyperlang/vyper/commit/3d9c537142fb99b2672f21e2057f5f202cde194f","https://github.com/advisories/GHSA-4hwq-4cpm-8vmx"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"PYSEC-2024-205","url":"https://osv.dev/vulnerability/PYSEC-2024-205"}],"summary":"Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. When using the built-in `extract32(b, start)`, if the `start` index provided has for side effect to update `b`, the byte a"}