CVE-2026-114117

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-114117
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114117.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-114117
Aliases
  • GHSA-6j9c-gvcw-74fj
Published
2026-10-21T00:37:14Z
Modified
2026-10-21T10:46:32Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Vyper 0.3.8 through 0.5.0b1 Optimizer Miscompilation of msg.value | K in Ternary Branches
Details

Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas (the default) or -O codesize. Affected contracts use the wrong value in storage writes, arithmetic, indexes, return values, or events without warning or revert, which can record deposits incorrectly and lock funds.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-682"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114117.json"
}
References

Affected packages

Git / github.com/vyperlang/vyper

Affected ranges

Type
GIT
Repo
https://github.com/vyperlang/vyper
Events
Introduced
036f153683e0d55b890305eb4c77680a0872fcba
Last Affected
577d2534356903076bb79b5b15ebd4d772994693
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0.3.8"
                },
                {
                    "last_affected":  "0.5.0b1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Affected versions

v0.*
v0.3.10
v0.3.10rc1
v0.3.10rc2
v0.3.10rc3
v0.3.10rc4
v0.3.10rc5
v0.3.8
v0.3.9
v0.4.0
v0.4.0b1
v0.4.0b2
v0.4.0b3
v0.4.0b4
v0.4.0b5
v0.4.0b6
v0.4.0rc1
v0.4.0rc2
v0.4.0rc3
v0.4.0rc4
v0.4.0rc5
v0.4.0rc6
v0.4.1
v0.4.1b1
v0.4.1b2
v0.4.1b3
v0.4.1b4
v0.4.1rc1
v0.4.1rc2
v0.4.1rc3
v0.4.2
v0.4.2rc1
v0.4.3
v0.4.3rc1
v0.5.0a1
v0.5.0a2
v0.5.0a3
v0.5.0b1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114117.json"