GHSA-7vrm-3jc8-5wwm CVE-2022-24787 PYSEC-2022-196

Incorrect Comparison in Vyper

High PyPI

Severity: 7.5 / 10; High · CVSS 3.1
Exploit chance (EPSS): 1.03%; Chance of exploitation in the next 30 days. Higher than 63.70% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-697 Incorrect Comparison
Fix: 0.3.2; Upgrade vyper to this version or later

Description

Impact

bytestrings can have dirty bytes in them, resulting in the word-for-word comparison to give incorrect results, e.g.

b1: Bytes[32] = b"abcdef"
b1 = slice(b1, 0, 1)
b2: Bytes[32] = b"abcdef"
t: bool = b1 == b2  # incorrectly evaluates to True

even without dirty nonzero bytes, because there is no comparison of the length, two bytestrings can compare to equal if one ends with "\x00".

b1: Bytes[32] = b"abc\0"
b2: Bytes[32] = b"abc"
t: bool = b1 == b2  # incorrectly evaluates to True

Patches

fixed in https://github.com/vyperlang/vyper/commit/2c73f8352635c0a433423a5b94740de1a118e508

Affected versions

PyPI

Package	Vulnerable	Fixed in
vyper	`< 0.3.2`	`0.3.2`
vyper	`< 0.3.2`	`0.3.2`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

vyper PyPI → `0.3.2`

pip

pip install --upgrade "vyper>=0.3.2"

poetry

poetry add "vyper>=0.3.2"

uv

uv add "vyper>=0.3.2"

Severity breakdown

CVSS 3.1 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: High
Availability: None

Weakness

CWE-697: Incorrect Comparison

The product compares two entities in a security-relevant context, but the comparison is incorrect.

References

Packages

github.com/vyperlang/vyper

Timeline

Apr 4, 2022 Published
Dec 5, 2024 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-2r3x-4mrv-mcxf Vyper: Memory corruption using function calls within tuples / nested calls	Medium	Also affects vyper
GHSA-4v7v-gqf9-ww2g Vyper: Call stack corruption when passing complex type containing non-base type members as argument	Medium	Also affects vyper
GHSA-vg88-3v92-rjx2 Vyper: Return inside for loop more than 1 level deep	Low	Also affects vyper
GHSA-3vcg-j39x-cwfm Vyper's `slice()` may elide side-effects when output length is 0	Low	Also affects vyper
GHSA-qhr6-mgqr-mchm Vyper's `concat()` builtin may elide side-effects for zero-length arguments	Low	Also affects vyper
GHSA-h33q-mhmp-8p67 Vyper has a double eval in For List Iter	High	Also affects vyper
GHSA-4w26-8p97-f4jp AugAssign evaluation order causing OOB write within the object in Vyper	Critical	Also affects vyper
GHSA-2p94-8669-xg86 Vyper's sqrt doesn't define rounding behavior	High	Also affects vyper

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor