{"cve":"CVE-2020-37288","nvd":{"published":"2026-10-21T01:17:18.683","modified":"2026-10-22T17:39:56.760","status":"Awaiting Analysis","description":"Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination (stack underflow). Affected contracts revert such calls unnecessarily, which in limited circumstances could enable denial of service against public contracts.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":6.3},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","score":3.7},"cwes":["CWE-670"],"references":["https://github.com/vyperlang/vyper/security/advisories/GHSA-vg88-3v92-rjx2","https://www.vulncheck.com/advisories/vyper-0.1-0b10-before-0.2.3-invalid-jump-destination-via-return-in-nested-loops"],"products":[],"source":"nvd","synced_at":"2026-10-23T16:39:26.291718493+00:00"},"epss":{"cve":"CVE-2020-37288","score":0.00347,"percentile":0.28012,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-vg88-3v92-rjx2","url":"https://osv.dev/vulnerability/GHSA-vg88-3v92-rjx2","summary":"Vyper: Return inside for loop more than 1 level deep","modified":"2026-10-24T02:56:09.007506586Z","packages":[{"ecosystem":"PyPI","name":"vyper","purl":"pkg:pypi/vyper","ranges":[">=0.1.0b10 <0.2.3"],"fixed":["0.2.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}