CVE-2021-48019
Medium · 4.8CVSS
4.8
EPSS
0.2%
Published
Oct 21, 2026
CISA due date
—
The record
Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data when a function returns more than 4096 bytes without return data sanitation, and fail strict return-size checks such as SafeERC20.safeTransfer.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-6695 A flaw was found in GIMP. CWE-805
- CVE-2026-53877 An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. CWE-805
- CVE-2026-12549 The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced… CWE-805
- CVE-2026-1767 A flaw was found in the GNOME localsearch (previously known as tracker-miners) MP3… CWE-805
- CVE-2026-1766 A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor… CWE-805
- CVE-2026-12087 Socket versions before 2.041 for Perl have an out-of-bounds heap read. CWE-805
- CVE-2026-34002 A flaw was found in the X.Org X server. CWE-805
- CVE-2025-63547 An issue in Eprosima Micro-XREC-DDS Agent v.3.0.1 allows a remote attacker to cause a… CWE-805