Live › vulnerability › CVE-2026-114663
Go to dashboardVyper >=0.4.0b1 (through 0.5.0b1 and master) compiles unfoldable imported constants and omitted default arguments in the using function's scope. A same-named parameter, local or loop variable from the calling contract replaces the intended value, even pushing out-of-range values into narrow types like uint8. The colliding declaration must be in an imported module, and the replaced expression must stay unfoldable. An external user controls the value only if the captured variable derives from user input. No patched release exists yet.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| vyper | pip | >= 0.4.0b1, <= 0.5.0b1 (and master 17e925db) | – |
pip show vyper (0.4.0b1 and later is affected)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name, attacker-influenced input can replace the intended value, including out-of-range values for narrow types such as uint8, corrupting validation or accounting logic.
This page as .md · .json · in your agent: get_signal("CVE-2026-114663")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.