Live › vulnerability › CVE-2026-114117
Go to dashboardVyper versions 0.3.8 through 0.5.0b1 have an optimizer bug: when (msg.value | K) or (len(msg.data) | K) appears as a ternary branch, it compiles to the constant 1 under default gas or codesize optimization. Affected contracts can silently record wrong deposits, wrong storage values or wrong return values, which can lock funds.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Projects that compile Vyper contracts with versions from 0.3.8 through 0.5.0b1 under the default gas or codesize optimization, and whose code uses a bitwise OR with msg.value or len(msg.data) inside a ternary branch. Contracts compiled with other Vyper versions, or that do not use this expression pattern, are not described as affected.
No product ranges from the sources yet.
vyper --version or the pinned version in requirements.txt or pyproject.toml.msg.value | or len(msg.data) |.0.5.0b1 that contains the fix, then recompile and redeploy affected contracts.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas (the default) or -O codesize. Affected contracts use the wrong value in storage writes, arithmetic, indexes, return values, or events without warning or revert, which can record deposits incorrectly and lock funds.
This page as .md · .json · in your agent: get_signal("CVE-2026-114117")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.