CVE-2023-39363
CVE-2023-39363 is a medium-severity vulnerability in Vyperlang Vyper with a CVSS 3.x base score of 5.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-863.
Key facts
- Severity: Medium (CVSS 3.x base score 5.9)
- CVSS v4: 9.1
- EPSS exploit prediction: 1% (49th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-863
- Affected product: Vyperlang Vyper
- Published:
- Last modified:
Description
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in contracts compiled with the susceptible versions. A specific set of conditions is required to result in misbehavior of affected contracts, specifically: a `.vy` contract compiled with `vyper` versions `0.2.15`, `0.2.16`, or `0.3.0`; a primary function that utilizes the `@nonreentrant` decorator with a specific `key` and does not strictly follow the check-effects-interaction pattern (i.e. contains an external call to an untrusted party before storage updates); and a secondary function that utilizes the same `key` and would be affected by the improper state caused by the primary function. Version 0.3.1 contains a fix for this issue.
Frequently asked questions
- What is CVE-2023-39363?
- Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in contracts compiled with the susceptible versions. A specific set of conditions is required to result in misbehavior of affected contracts, specifically: a `.vy` contract compiled with `vyper` versions `0.2.15`, `0.2.16`, or `0.3.0`; a primary function that utilizes the `@nonreentrant` decorator with a specific `key` and does not strictly follow the check-effects-interaction pattern (i.e. contains an external call to an untrusted party before storage updates); and a secondary function that utilizes the same `key` and would be affected by the improper state caused by the primary function. Version 0.3.1 contains a fix for this issue.
- How severe is CVE-2023-39363?
- CVE-2023-39363 has a CVSS 3.x base score of 5.9, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.
- Is CVE-2023-39363 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (49th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2023-39363?
- CVE-2023-39363 primarily affects Vyperlang Vyper. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2023-39363?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2023-39363 published?
- CVE-2023-39363 was published on 2023-08-07 and last updated on 2026-06-17.
References
- https://github.com/vyperlang/vyper/pull/2439
- https://github.com/vyperlang/vyper/pull/2514
- https://github.com/vyperlang/vyper/security/advisories/GHSA-5824-cm3x-3c38
- https://hackmd.io/@LlamaRisk/BJzSKHNjn
- https://hackmd.io/@vyperlang/HJUgNMhs2
Affected products (3)
- cpe:2.3:a:vyperlang:vyper:0.2.15:*:*:*:*:python:*:*
- cpe:2.3:a:vyperlang:vyper:0.2.16:*:*:*:*:python:*:*
- cpe:2.3:a:vyperlang:vyper:0.3.0:*:*:*:*:python:*:*
More vulnerabilities in Vyperlang Vyper
- CVE-2024-24563 — Critical (CVSS 9.8): Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. Arrays can be keyed by a signed integer,…
- CVE-2024-24561 — Critical (CVSS 9.8): Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.10 and earlier, the…
- CVE-2025-27105 — Critical (CVSS 9.1): vyper is a Pythonic Smart Contract Language for the EVM. Vyper handles AugAssign statements by first caching the target…
- CVE-2022-24845 — High (CVSS 8.8): Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In affected versions, the return of…
- CVE-2022-29255 — High (CVSS 8.2): Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions prior to 0.3.4 when a calling…
- CVE-2023-42443 — High (CVSS 8.1): Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In version 0.3.9 and prior, under…
All CVEs affecting Vyperlang Vyper →
Other CWE-863 (Incorrect Authorization) vulnerabilities
- CVE-2026-48286 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization…
- CVE-2026-48303 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect Authorization…
- CVE-2026-44330 — Critical (CVSS 10.0): free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the…
- CVE-2026-46595 — Critical (CVSS 10.0): Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of…
- CVE-2026-33105 — Critical (CVSS 10.0): Improper authorization in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over…
- CVE-2026-32213 — Critical (CVSS 10.0): Improper authorization in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
Browse all CWE-863 (Incorrect Authorization) vulnerabilities →