CVE-2020-37288CWE-670

CVE-2020-37288

Low · published October 21, 2026

CVSS v3.1
3.7
EPSS
0%
Percentile
19.8
In the wild
Unconfirmed
What it is

Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination (stack underflow). Affected contracts revert such calls unnecessarily, which in limited circumstances could enable denial of service against public contracts.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
6.3 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00284 · 19.8th percentile
Weakness
CWE-670 · Always-Incorrect Control Flow Implementation
Published
2026-10-21T05:17Z
References (2)
https://github.com/vyperlang/vyper/security/advisories/GHSA-vg88-3v92-rjx2 · [email protected]https://www.vulncheck.com/advisories/vyper-0.1-0b10-before-0.2.3-invalid-jump-destination-via-return-in-nested-loops · [email protected]
EPSS history
Timeline
  • 22 OCT 03:14Z
    EPSS moved — → 0%
    epss
  • 21 OCT 00:36Z
    Vyper 0.1.0b10 before 0.2.3 Invalid Jump Destination via Return in Nested Loops
    cvelistv5
  • 21 OCT 00:36Z
    Vyper 0.1.0b10 before 0.2.3 Invalid Jump Destination via Return in Nested Loops
    cvelistv5