CVE-2021-48019

4.8 MEDIUMpublic exploit available

Published 2026-10-21 · Updated 2026-10-22

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data when a function returns more than 4096 bytes without return data sanitation, and fail strict return-size checks such as SafeERC20.safeTransfer.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Weaknesses

CWE-805

Public exploit & PoC references

https://github.com/vyperlang/vyper/security/advisories/GHSA-375m-5fvv-xq23

All references

https://github.com/vyperlang/vyper/security/advisories/GHSA-375m-5fvv-xq23
https://www.vulncheck.com/advisories/vyper-before-0.2.9-incorrect-returndatasize-in-create-forwarder-to-proxies

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

UNSCOREDCVE-2025-58774
MEDIUMCVE-2026-20011
MEDIUMCVE-2026-92159PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.