CVE-2026-114116

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-114116
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114116.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-114116
Aliases
  • GHSA-wvx7-39qj-2g9v
Published
2026-10-21T00:37:13Z
Modified
2026-10-21T10:45:18Z
Severity
  • 6.0 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Vyper through 0.5.0b1 Literal Value Manipulation via Line Separators
Details

Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker contributing source code can hide these characters in comments, strings or indentation to silently change address, integer or decimal constants.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-436"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114116.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "0.1.0b1"
                        },
                        {
                            "fixed":  "0.1.0b17"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandardRange"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/vyperlang/vyper

Affected ranges

Type
GIT
Repo
https://github.com/vyperlang/vyper
Events
Introduced
8a93dd27de503b0a3ace36d961a10c9ea4adee8b
Last Affected
577d2534356903076bb79b5b15ebd4d772994693
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0.4.1"
                },
                {
                    "last_affected":  "0.5.0b1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Affected versions

v0.*
v0.4.1
v0.4.2
v0.4.2rc1
v0.4.3
v0.4.3rc1
v0.5.0a1
v0.5.0a2
v0.5.0a3
v0.5.0b1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114116.json"