CVE-2025-26622
published 2025-02-21CVE-2025-26622: vyper is a Pythonic Smart Contract Language for the EVM. Vyper `sqrt()` builtin uses the babylonian method to calculate square roots of decimals…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
0.30%
22.1th percentile
vyper is a Pythonic Smart Contract Language for the EVM. Vyper `sqrt()` builtin uses the babylonian method to calculate square roots of decimals. Unfortunately, improper handling of the oscillating final states may lead to sqrt incorrectly returning rounded up results. This issue is being addressed and a fix is expected in version 0.4.1. Users are advised to upgrade as soon as the patched release is available. There are no known workarounds for this vulnerability.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vyperlang | vyper | < 0.4.1 | 0.4.1 |
| vyperlang | vyper | >= 0 < 0.4.1 | 0.4.1 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv4.02.3LOWCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2025-26622: vyper is a Pythonic Smart Contract Language for the EVM
osv·2025-02-21
CVE-2025-26622 CVE-2025-26622: vyper is a Pythonic Smart Contract Language for the EVM
vyper is a Pythonic Smart Contract Language for the EVM. Vyper `sqrt()` builtin uses the babylonian method to calculate square roots of decimals. Unfortunately, improper handling of the oscillating final states may lead to sqrt incorrectly returning rounded up results. This issue is being addressed and a fix is expected in version 0.4.1. Users are advised to upgrade as soon as the patched release is available. There are no known workarounds for this vulnerability.
OSV
Vyper's sqrt doesn't define rounding behavior
osv·2025-02-21
CVE-2025-26622 [LOW] Vyper's sqrt doesn't define rounding behavior
Vyper's sqrt doesn't define rounding behavior
Vyper's `sqrt()` builtin uses the babylonian method to calculate square roots of decimals. Unfortunately, improper handling of the oscillating final states may lead to sqrt incorrectly returning rounded up results.
the fix is tracked in https://github.com/vyperlang/vyper/pull/4486
### Vulnerability Details
Vyper injects the following code to handle calculation of decimal sqrt. x is the input provided by user.
```python
assert x >= 0.0
z: decimal = 0.0
if x == 0.0:
z = 0.0
else:
z = x / 2.0 + 0.5
y: decimal = x
for i: uint256 in range(256):
if z == y:
break
y = z
z = (x / z + z) / 2.0
```
Notably, the terminal condition of the algorithm is either `z_cur == z_prev`, or the algorithm runs for 256 rounds.
However, for certain inputs, `z` mig
GHSA
Vyper's sqrt doesn't define rounding behavior
ghsa·2025-02-21
CVE-2025-26622 [LOW] CWE-682 Vyper's sqrt doesn't define rounding behavior
Vyper's sqrt doesn't define rounding behavior
Vyper's `sqrt()` builtin uses the babylonian method to calculate square roots of decimals. Unfortunately, improper handling of the oscillating final states may lead to sqrt incorrectly returning rounded up results.
the fix is tracked in https://github.com/vyperlang/vyper/pull/4486
### Vulnerability Details
Vyper injects the following code to handle calculation of decimal sqrt. x is the input provided by user.
```python
assert x >= 0.0
z: decimal = 0.0
if x == 0.0:
z = 0.0
else:
z = x / 2.0 + 0.5
y: decimal = x
for i: uint256 in range(256):
if z == y:
break
y = z
z = (x / z + z) / 2.0
```
Notably, the terminal condition of the algorithm is either `z_cur == z_prev`, or the algorithm runs for 256 rounds.
However, for certain inputs, `z` mig
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-02-21
Published