PT-2025-7605 · Vyper · Vyper

Charles-Cooper · Published 2025-02-21 · Updated 2025-02-26 · CVE-2025-26622

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Vyper versions prior to 0.4.1

Description The issue arises from the improper handling of oscillating final states in the sqrt() function, which uses the babylonian method to calculate square roots of decimals. This can lead to sqrt() incorrectly returning rounded up results. The impact of this issue is considered low, as sqrt() is rarely used in the wild. However, since sqrt() can be used for determining boundary conditions, rounding down is preferred.

Recommendations For versions prior to 0.4.1, upgrade to version 0.4.1 as soon as the patched release is available. As a temporary workaround, consider avoiding the use of the sqrt() function until a patch is available. Restrict the use of the sqrt() function in critical calculations to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-682

Related Identifiers

CVE-2025-26622

GHSA-2P94-8669-XG86

PYSEC-2025-29

Affected Products

Vyper

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/26xxx/CVE-2025-26622.json · Exploit
• https://github.com/vyperlang/vyper/pull/4486 · Patch
• https://github.com/vyperlang/vyper/security/advisories/GHSA-2p94-8669-xg86 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2p94-8669-xg86 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-26622 · Security Note
• https://osv.dev/vulnerability/CVE-2025-26622 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2025-29 · Vendor Advisory
• https://github.com/vyperlang/vyper · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2025-29.yaml · Note
• https://twitter.com/WolfgangSesin/status/1893074479896523129 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1893080815891865620 · Twitter Post
• https://twitter.com/CVEnew/status/1893055686944129162 · Twitter Post
• https://t.me/cvedetector/18694 · Telegram Post
• https://twitter.com/cracbot/status/1894704101864468904 · Twitter Post
• https://t.me/cvenotify/112151 · Telegram Post