Live › vulnerability › CVE-2026-114115
Go to dashboardVyper versions 0.3.8 through 0.5.0b1 compile a ternary expression that selects a nested array with narrower inner bounds using the wider type's memory layout. Contracts compiled this way can silently store corrupted values or revert.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that compile Vyper contracts with a compiler in the affected range and whose code uses a conditional expression that picks between nested arrays of different inner sizes. Contracts that do not use that pattern, or that were built with a compiler outside the range, are not affected by this report.
No product ranges from the sources yet.
vyper --version, and see whether it falls in 0.3.8 through 0.5.0b1.if ... else) expressions that select between nested array types of different inner lengths.0.5.0b1, then recompile and redeploy affected contracts.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that reads nested arrays with narrower inner bounds using the wider result type's memory layout. When a ternary selects the narrower array, inner arrays after the first are read at wrong offsets, causing contracts to silently store corrupted values or revert.
This page as .md · .json · in your agent: get_signal("CVE-2026-114115")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.