CVE-2023-42441

Vyper has incorrect re-entrancy lock when key is empty string

5.3 MediumFix available

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Starting in version 0.2.9 and prior to version 0.3.10, locks of the type @nonreentrant("") or @nonreentrant('') do not produce reentrancy checks at runtime. This issue is fixed in version 0.3.10. As a workaround, ensure the lock name is a non-empty string.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Exploit likelihood

0.51%Up 0.5 points since Sep 19, 2023

What each source reports

CVE List Score used 5.3

Vyper has incorrect re-entrancy lock when key is empty string

Record: CVE-2023-42441
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-833
Updated: 2026-11-02

EUVDEUVD-2023-0274 5.3

Record: EUVD-2023-0274
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-3hg2-r75x-g69m 5.3

Vyper has incorrect re-entrancy lock when key is empty string

Impact

Locks of the type @nonreentrant("") or @nonreentrant('') do not produce reentrancy checks at runtime.

@nonreentrant("") # unprotected
@external
def bar():
    pass

@nonreentrant("lock") # protected
@external
def foo():
    pass

Patches

Patched in #3605

Workarounds

The lock name should be a non-empty string.

References

Are there any links users can visit to find out more?

Record: GHSA-3hg2-r75x-g69m
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-667, CWE-833
Updated: 2026-11-02

NVD 5.3

Record: CVE-2023-42441
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-833, CWE-667
Updated: 2026-11-02

OSV 5.3

Vyper has incorrect re-entrancy lock when key is empty string

Record: CVE-2023-42441
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-833
Updated: 2026-11-02

OSVGHSA-3hg2-r75x-g69m 5.3

Vyper has incorrect re-entrancy lock when key is empty string

Impact

Locks of the type @nonreentrant("") or @nonreentrant('') do not produce reentrancy checks at runtime.

@nonreentrant("") # unprotected
@external
def bar():
    pass

@nonreentrant("lock") # protected
@external
def foo():
    pass

Patches

Patched in #3605

Workarounds

The lock name should be a non-empty string.

References

Are there any links users can visit to find out more?

Record: GHSA-3hg2-r75x-g69m
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-667, CWE-833
Updated: 2026-11-02

OSVPYSEC-2023-305 5.3

Record: PYSEC-2023-305
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

Affected products

vyperlang vyper

Affected packages

Affected packages
Package	Affected	Fixed
`vyper` PyPI	0.2.9 up to 0.3.10	0.3.10
`vyper` PyPI	0.2.9 up to 0.3.10, plus listed versions 0.2.100.2.110.2.120.2.130.2.14 Show 17 moreShow less 0.2.150.2.160.3.00.3.10.3.10rc10.3.10rc20.3.10rc30.3.10rc40.3.10rc50.3.20.3.30.3.40.3.50.3.60.3.70.3.80.3.9	0.3.10

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-42441 is a medium vulnerability (CVSS 5.3) in Vyperlang Vyper, published September 18, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.51%, the 44th percentile. Fixed in vyper 0.3.10.