CVE-2026-114663
published 2026-10-22CVE-2026-114663: Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in…
PriorityP344high8.4CVSS 3.1
AVLACLPRNUINSUCHIHAH
EPSS
0.14%
2.8th percentile
Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name, attacker-influenced input can replace the intended value, including out-of-range values for narrow types such as uint8, corrupting validation or accounting logic.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vyperlang | vyper | 0.4.0b1 – 0.5.0b1 | — |
CVSS provenance
nvdv3.18.4HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.08.6HIGHCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-114663 vyper: Vyper: Contract logic corruption via improper name resolution of imported constants [fedora-rawhide]
bugzilla·2026-10-22·CVSS 8.4
CVE-2026-114663 [HIGH] CVE-2026-114663 vyper: Vyper: Contract logic corruption via improper name resolution of imported constants [fedora-rawhide]
CVE-2026-114663 vyper: Vyper: Contract logic corruption via improper name resolution of imported constants [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name, attacker-influenced input can replace the intended value, including out-of-range values for narrow types such as uint8, corrupting validation or accounting logic.
Bugzilla
CVE-2026-114663 vyper: Vyper: Contract logic corruption via improper name resolution of imported constants [fedora-43]
bugzilla·2026-10-22·CVSS 8.4
CVE-2026-114663 [HIGH] CVE-2026-114663 vyper: Vyper: Contract logic corruption via improper name resolution of imported constants [fedora-43]
CVE-2026-114663 vyper: Vyper: Contract logic corruption via improper name resolution of imported constants [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name, attacker-influenced input can replace the intended value, including out-of-range values for narrow types such as uint8, corrupting validation or accounting logic.
Bugzilla
CVE-2026-114663 vyper: Vyper: Contract logic corruption via improper name resolution of imported constants [fedora-44]
bugzilla·2026-10-22·CVSS 8.4
CVE-2026-114663 [HIGH] CVE-2026-114663 vyper: Vyper: Contract logic corruption via improper name resolution of imported constants [fedora-44]
CVE-2026-114663 vyper: Vyper: Contract logic corruption via improper name resolution of imported constants [fedora-44]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name, attacker-influenced input can replace the intended value, including out-of-range values for narrow types such as uint8, corrupting validation or accounting logic.
Bugzilla
CVE-2026-114663 vyper: Vyper: Contract logic corruption via improper name resolution of imported constants
bugzilla·2026-10-22·CVSS 8.4
CVE-2026-114663 [HIGH] CVE-2026-114663 vyper: Vyper: Contract logic corruption via improper name resolution of imported constants
CVE-2026-114663 vyper: Vyper: Contract logic corruption via improper name resolution of imported constants
Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name, attacker-influenced input can replace the intended value, including out-of-range values for narrow types such as uint8, corrupting validation or accounting logic.
2026-10-22
Published