---
id: "CVE-2026-114117"
kind: "vulnerability"
aliases: ["CVE-2026-114117"]
title: "Vyper: optimizer miscompiles msg.value expressions, corrupting contract state and funds"
severity: "high"
cvss: 8.2
epss: 0.00207
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ethereum", "package", "python", "smart-contracts", "vyper"]
not_affected_if: ["no-ternary-pattern", "other-vyper-version"]
published_at: "2026-10-21T01:17:38+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T03:03:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114117", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114117", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Vyper: optimizer miscompiles msg.value expressions, corrupting contract state and funds

Vyper versions 0.3.8 through 0.5.0b1 have an optimizer bug: when (msg.value | K) or (len(msg.data) | K) appears as a ternary branch, it compiles to the constant 1 under default gas or codesize optimization. Affected contracts can silently record wrong deposits, wrong storage values or wrong return values, which can lock funds.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Vyper compiler version in the project, for example `vyper --version` or the pinned version in `requirements.txt` or `pyproject.toml`.
- Search Vyper source for ternary expressions that use `msg.value |` or `len(msg.data) |`.
- unknown whether the sources list other checks.

## Fix

- Upgrade Vyper to a release after `0.5.0b1` that contains the fix, then recompile and redeploy affected contracts.
- unknown exact fixed version: the sources do not name it.

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114117
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114117

## From the sources

Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas (the default) or -O codesize. Affected contracts use the wrong value in storage writes, arithmetic, indexes, return values, or events without warning or revert, which can record deposits incorrectly and lock funds.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_