GHSA-4v7v-gqf9-ww2g

Vyper: Call stack corruption when passing complex type containing non-base type members as argument

Risk score: 46/100
CVSS: 6.9 v4.0
Published: 6 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: When we pass a multi-dimensional array (like [[1, 2], [3, 4]]) as an argument to internal/external functions we get incorrect output. This is due to a stack management issue, because it was assumed that the size of each subtype of an array/struct is 32, which is not always correct. Example code: python @internal def t…
Affected: vyper (pip) < 0.2.6
Fix: Upgrade vyper to 0.2.6 or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

vyper: Yellow, plan it in. When we pass a multi-dimensional array (like [[1, 2], [3, 4]]) as an argument to internal/external functions we get incorrect output. This is due to a stack management issue, because it was assumed that the size of each subtype of an array/struct is 32, which is not always correct. Example code: python @internal def t…

The flaws

GHSA-4v7v-gqf9-ww2g: Vyper: Call stack corruption when passing complex type containing non-base type members as argument (CVSS 6.9)
GHSA-2r3x-4mrv-mcxf: Vyper: Memory corruption using function calls within tuples / nested calls (CVSS 6.9)
GHSA-vg88-3v92-rjx2: Vyper: Return inside for loop more than 1 level deep (CVSS 6.3)

The fix

Fix: Upgrade vyper to 0.2.6 or later.

Who is exposed: vyper (pip) < 0.2.6

Where it stands

No known exploitation

Connects to

Same weakness: CWE-682 (CWE-682). 5 other warnings in 30 days

Why it is Yellow

CVSS 6.9 medium
On your watchlist: PyPI

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
vyper	pip	< 0.2.6	0.2.6

References

Original description

### Impact When we pass a multi-dimensional array (like `[[1, 2], [3, 4]]`) as an argument to internal/external functions we get incorrect output. This is due to a stack management issue, because it was assumed that the size of each subtype of an array/struct is 32, which is not always correct. Example code: ```python @internal def test_input(arr: int128[2][1], i: int128) -> (int128[2][1], int128): return arr, i @external def test_values(arr: int128[2][1], i: int128) -> (int128[2][1], int128): return self.test_input(arr, i) ``` Please see #2183 for further information ### Patches This problem was fixed in #2184, and released as a part of [`v0.2.6`](https://github.com/vyperlang/vyper/releases/tag/v0.2.6).

Last activity 6 Oct 2026. Patch Forecast updates every hour.