Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| vyperlang | vyper | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Thu, 22 Oct 2026 02:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name, attacker-influenced input can replace the intended value, including out-of-range values for narrow types such as uint8, corrupting validation or accounting logic. | |
| Title | Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments | |
| First Time appeared |
Vyperlang
Vyperlang vyper |
|
| Weaknesses | CWE-706 | |
| CPEs | cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Vyperlang
Vyperlang vyper |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-10-22T01:43:46.942Z
Reserved: 2026-10-21T21:59:05.257Z
Link: CVE-2026-114663
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-22T02:16:58.603
Modified: 2026-10-22T02:16:58.603
Link: CVE-2026-114663
Redhat
No data.
OpenCVE Enrichment
No data.