CVE-2022-24787— Incorrect Comparison in Vyper
Quick assessment
Affected
vyperlang vyper
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Vyper是EVM 的 Pythonic 智能合约语言。 Vyper存在安全漏洞，该漏洞源于在版本0.3.1和之前的版本中，字节测试环中可能有脏字节，导致逐字比较给出错误的结果。即使没有脏的非零字节，如果一个字节以“x00”结尾，两个字节测试环也可以比较为相等，因为没有长度的比较。有一个补丁可用，预计将成为0.3.2版本的一部分。目前还没有已知的解决办法。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-24787
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Incorrect Comparison in Vyper
Source: CVE Program / CVE List V5
Vulnerability Description
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. In version 0.3.1 and prior, bytestrings can have dirty bytes in them, resulting in the word-for-word comparisons giving incorrect results. Even without dirty nonzero bytes, two bytestrings can compare to equal if one ends with `"\x00"` because there is no comparison of the length. A patch is available and expected to be part of the 0.3.2 release. There are currently no known workarounds.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的比较
Source: CVE Program / CVE List V5
Vulnerability Title
Vyper 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Vyper是EVM 的 Pythonic 智能合约语言。 Vyper存在安全漏洞，该漏洞源于在版本0.3.1和之前的版本中，字节测试环中可能有脏字节，导致逐字比较给出错误的结果。即使没有脏的非零字节，如果一个字节以“x00”结尾，两个字节测试环也可以比较为相等，因为没有长度的比较。有一个补丁可用，预计将成为0.3.2版本的一部分。目前还没有已知的解决办法。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2022-24787
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-24787
请登录查看更多情报信息。
Patches & Fixes for CVE-2022-24787 (1)
Vendor Advisories for CVE-2022-24787 (1)
-
https://github.com/vyperlang/vyper/security/advisories/GHSA-7vrm-3jc8-5wwm x_refsource_CONFIRM
IV. Related Vulnerabilities
Same product: vyper
-
CVE-2025-47774
Vyper's `slice()` may elide side-effects when output length -
CVE-2025-47285
Vyper's `concat()` builtin may elide side-effects for zero-l -
CVE-2025-26622
sqrt doesn't define rounding behavior in Vyper -
CVE-2025-27104
double eval in For List Iter in Vyper -
CVE-2025-27105
AugAssign evaluation order causing OOB write within the obje
Same vendor: vyperlang
-
CVE-2025-47774
Vyper's `slice()` may elide side-effects when output length -
CVE-2025-47285
Vyper's `concat()` builtin may elide side-effects for zero-l -
CVE-2025-26622
sqrt doesn't define rounding behavior in Vyper -
CVE-2025-27104
double eval in For List Iter in Vyper -
CVE-2025-27105
AugAssign evaluation order causing OOB write within the obje
Same weakness: CWE-697
-
CVE-2026-73258
Mongoose: Multipart boundary/header scan logic error in mg_h -
CVE-2026-75110
MemOS Authentication Bypass via Unset INTERNAL_SERVICE_SECRE -
CVE-2026-50029
js-toml has silent type confusion via falsy-primitive duplic -
CVE-2026-67207
Wolf CMS 0.8.3.1 Authorization Bypass via BackupRestoreContr -
CVE-2026-48032
Hulumi: IAM-role policy checks bypassed when the role trusts
V. Comments for CVE-2022-24787
No comments yet