CVE-2021-48019

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2021-48019", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-20T21:51:44.816Z", "datePublished": "2026-10-21T00:36:18.960Z", "dateUpdated": "2026-10-27T21:35:59.282Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-21T00:36:18.960Z"}, "datePublic": "2021-04-16T00:00:00.000Z", "title": "Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies", "descriptions": [{"lang": "en", "value": "Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data when a function returns more than 4096 bytes without return data sanitation, and fail strict return-size checks such as SafeERC20.safeTransfer."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Buffer Access with Incorrect Length Value", "cweId": "CWE-805", "type": "CWE"}]}], "affected": [{"vendor": "vyperlang", "product": "vyper", "defaultStatus": "unaffected", "packageURL": "pkg:pypi/vyper", "versions": [{"version": "0", "status": "affected", "versionType": "python", "lessThan": "0.2.9"}, {"version": "0.2.9", "status": "unaffected", "versionType": "python"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*", "versionEndExcluding": "0.2.9"}]}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 6.3, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS"}, {"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "format": "CVSS"}], "references": [{"url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-375m-5fvv-xq23", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-375m-5fvv-xq23)"}, {"name": "VulnCheck Advisory: Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/vyper-before-0.2.9-incorrect-returndatasize-in-create-forwarder-to-proxies"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-27T21:35:49.406598Z", "id": "CVE-2021-48019", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-27T21:35:59.282Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2021-48019", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-20T21:51:44.816Z", "datePublished": "2026-10-21T00:36:18.960Z", "dateUpdated": "2026-10-27T21:35:59.282Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-21T00:36:18.960Z"}, "datePublic": "2021-04-16T00:00:00.000Z", "title": "Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies", "descriptions": [{"lang": "en", "value": "Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data when a function returns more than 4096 bytes without return data sanitation, and fail strict return-size checks such as SafeERC20.safeTransfer."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Buffer Access with Incorrect Length Value", "cweId": "CWE-805", "type": "CWE"}]}], "affected": [{"vendor": "vyperlang", "product": "vyper", "defaultStatus": "unaffected", "packageURL": "pkg:pypi/vyper", "versions": [{"version": "0", "status": "affected", "versionType": "python", "lessThan": "0.2.9"}, {"version": "0.2.9", "status": "unaffected", "versionType": "python"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*", "versionEndExcluding": "0.2.9"}]}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 6.3, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS"}, {"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "format": "CVSS"}], "references": [{"url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-375m-5fvv-xq23", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-375m-5fvv-xq23)"}, {"name": "VulnCheck Advisory: Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/vyper-before-0.2.9-incorrect-returndatasize-in-create-forwarder-to-proxies"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-48019", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-27T21:35:49.406598Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-27T21:35:54.378Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:pypi/vyper", "product": "vyper", "vendor": "vyperlang", "versions": [{"lessThan": "0.2.9", "status": "affected", "version": "0", "versionType": "python"}, {"status": "unaffected", "version": "0.2.9", "versionType": "python"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data when a function returns more than 4096 bytes without return data sanitation, and fail strict return-size checks such as SafeERC20.safeTransfer."}], "id": "CVE-2021-48019", "lastModified": "2026-10-27T22:17:08.050", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 2.5, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2021-48019", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-27T21:35:49.406598Z", "version": "2.0.3"}}]}, "published": "2026-10-21T01:17:19.130", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-375m-5fvv-xq23"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/vyper-before-0.2.9-incorrect-returndatasize-in-create-forwarder-to-proxies"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-805"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "vyper: vyper: data corruption via fixed return data size in forwarder proxies", "id": "2558000", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558000"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L", "status": "draft"}, "cwe": "CWE-130", "details": ["Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data when a function returns more than 4096 bytes without return data sanitation, and fail strict return-size checks such as SafeERC20.safeTransfer.", "A flaw was found in Vyper. Forwarder proxies created using the built-in create_forwarder_to function report a fixed return data size instead of the actual data length returned by the target contract. A remote caller or interacting smart contract can encounter data corruption when returned payloads exceed the fixed limit without proper sanitization. Additionally, external callers that strictly validate return data length may fail assertions, leading to unexpected transaction reverts and Denial of Service (DoS)."], "name": "CVE-2021-48019", "public_date": "2026-10-21T00:36:18Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-48019\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-48019\nhttps://github.com/vyperlang/vyper/security/advisories/GHSA-375m-5fvv-xq23\nhttps://www.vulncheck.com/advisories/vyper-before-0.2.9-incorrect-returndatasize-in-create-forwarder-to-proxies"], "statement": "Red Hat Product Security has rated this issue as having a Moderate severity because exploitation requires interactions with specialized proxy smart contracts under specific payload conditions or strict response size validations. Vyper is not packaged, distributed, or supported within Red Hat Enterprise Linux or any other Red Hat enterprise products. Therefore, Red Hat environments and offerings are unaffected by this vulnerability.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.2.9)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "0.2.9"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "vyper", "source": "cna", "vendor": "vyperlang"}, "product": "vyper", "vendor": "vyperlang"}], "created": "2026-10-21T12:15:18.055442+00:00", "updated": "2026-11-02T14:45:18.369258+00:00", "vendors": ["vyperlang", "vyperlang$PRODUCT$vyper"]}