# CVE-2021-48018: Vyper storage variable corruption via @nonreentrant decorator

Source: https://junglewise.ai/threats/cve-2021-48018-vyper-from-0-2-13-before-0-2-15-allocates-storage-slots-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2021-48018 · Severity: high · CVSS 7.4 · Published 2026-10-21

Vyper, a programming language used to write smart contracts, has a critical flaw in versions 0.2.13 through 0.2.14 where the reentrancy protection decorator overwrites contract storage variables. This corruption breaks the contract's logic and could allow attackers to exploit the affected smart contracts for theft or unauthorized state manipulation.

Technologies: [Vyper](https://junglewise.ai/threats/technologies/vyper-vyper). Vendors: [Vyper](https://junglewise.ai/threats/vendors/vyper).

## Quick answers

**Is CVE-2021-48018 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-48018 being exploited in the wild.

**How severe is CVE-2021-48018?** High severity, with a CVSS score of 7.4, published 21 October 2026.

**Which products and versions are affected?** Vyper 0.2.13 to 0.2.14.

**Is there a fix for CVE-2021-48018?** Yes: fixed in 0.2.15. Until then: Do not use the @nonreentrant decorator in versions 0.2.13 through 0.2.14; upgrade to version 0.2.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-48018 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2021-48018?** Check whether you run Vyper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.2.15

Do not use the @nonreentrant decorator in versions 0.2.13 through 0.2.14; upgrade to version 0.2.15 or later.

## Technical details

The @nonreentrant decorator in Vyper allocates storage slots for reentrancy locks at the same memory addresses as contract state variables, causing the lock mechanism to overwrite critical data when activated. This is a storage layout collision bug triggered by any function call using @nonreentrant. The vulnerability was fixed in version 0.2.15.

## Affected products

- Vyper Vyper 0.2.13 to 0.2.14

## Timeline

- 2021-07-27: disclosed
- 2021-07-27: patched: Fixed in version 0.2.15

## References

- [https://github.com/vyperlang/vyper/security/advisories/GHSA-7f92-rr6w-cq64](https://github.com/vyperlang/vyper/security/advisories/GHSA-7f92-rr6w-cq64)
- [https://www.vulncheck.com/advisories/vyper-0.2.13-before-0.2.15-storage-corruption-via-nonreentrant-decorator](https://www.vulncheck.com/advisories/vyper-0.2.13-before-0.2.15-storage-corruption-via-nonreentrant-decorator)

## Related threats

- [Vyper name resolution scope vulnerability in constants and defaults](https://junglewise.ai/threats/cve-2026-114663-vyper-0-4-0b1-through-0-5-0b1-miscompiles-unfoldable-constants)
- [Vyper create_from_blueprint offset validation bypass via unsigned wraparound](https://junglewise.ai/threats/cve-2026-114118-vyper-0-3-4-through-0-5-0b1-computes-the-remaining-blueprint)
- [Vyper optimizer miscompilation in ternary expressions](https://junglewise.ai/threats/cve-2026-114117-vyper-0-3-8-through-0-5-0b1-contains-an-optimizer-miscompilation)
- [Vyper source-line table parsing allows numeric literal value manipulation](https://junglewise.ai/threats/cve-2026-114116-vyper-0-1-0b1-before-0-1-0b17-and-0-4-1-through-0-5-0b1-builds)
- [Vyper source literal value substitution via multi-byte characters](https://junglewise.ai/threats/cve-2026-114114-vyper-0-1-0b1-before-0-1-0b12-0-1-0b14-and-0-4-1-through-0-5-0b1)