CVE-2018-18920 - CVE House
Back to Database
Status published High CVE-2018-18920

Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.execute_bytecode call that...

Vulnerability Description

Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.execute_bytecode call that triggers computation._stack.values with '"stack": [100, 100, 0]' where b'\x' was expected, resulting in an execution failure because of an invalid opcode. This is reportedly related to "smart contracts can be executed indefinitely without gas being paid."

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-18920

Credits & Attribution

No credits recorded in the NVD database.

References

More from ethereum

View All →
CVE-2025-24883
go-ethereum has a DoS via malicious p2p message
High 8.7
CVE-2024-32972
go-ethereum denial of service via malicious p2p message
High 7.5
CVE-2023-40591
Denial of service via malicious p2p message in go-ethereum
High 7.5
CVE-2022-37450
Go Ethereum (aka geth) through 1.10.21 allows attackers to increase...
Medium 5.9
CVE-2022-29177
DoS via malicious p2p message in Go-Ethereum
Medium 5.9

Affected Vendor

Affected Software

py-evm
Vulnerable Versions:
0.2.0

Timeline

Official Publish: November 12th, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.