Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, `concat()` may skip evaluation of side effects when the length of an argument is zero. This is due to a fastpath in the implementation which skips evaluation of argument expressions when their length is zero. In practice, it would be very unusual in user code to construct zero-length bytestrings using an expression with side-effects, since zero-length bytestrings are typically constructed with the empty literal `b""`; the only way to construct an empty bytestring which has side effects would be with the ternary operator introduced in v0.3.8, e.g. `b"" if self.do_some_side_effect() else b""`. The fix is available in pull request 4644 and expected to be part of the 0.4.2 release. As a workaround, don't have side effects in expressions which construct zero-length bytestrings.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and
    including 0.4.2rc1, `concat()` may skip evaluation of side effects when the length of an argument is zero.
    This is due to a fastpath in the implementation which skips evaluation of argument expressions when their
    length is zero. In practice, it would be very unusual in user code to construct zero-length bytestrings
    using an expression with side-effects, since zero-length bytestrings are typically constructed with the
    empty literal `b""`; the only way to construct an empty bytestring which has side effects would be with
    the ternary operator introduced in v0.3.8, e.g. `b"" if self.do_some_side_effect() else b""`. The fix is
    available in pull request 4644 and expected to be part of the 0.4.2 release. As a workaround, don't have
    side effects in expressions which construct zero-length bytestrings. (CVE-2025-47285)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-510a78f439 advisory.

    A few fixes

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
446740	SCA: security update for vyper (GHSA-qhr6-mgqr-mchm)	Tenable Cloud Security	SCA Checks	Local	medium
446740	SCA: security update for vyper (GHSA-qhr6-mgqr-mchm)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
237228	Fedora 41 : vyper (2025-510a78f439)	Nessus	Fedora Local Security Checks	Local	medium

Detections

Analytics

CVE-2025-47285

medium

Tenable Plugins

medium

medium

medium