CVE-2026-114663

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-114663

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114663.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-114663

Aliases

GHSA-2489-32vh-8rrc

Published

2026-10-22T01:43:46Z

Modified

2026-10-22T10:46:12Z

Severity

8.6 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments

Details

Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name, attacker-influenced input can replace the intended value, including out-of-range values for narrow types such as uint8, corrupting validation or accounting logic.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-706"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114663.json"
}

References

Affected packages

Git / github.com/vyperlang/vyper

Affected ranges

Type

GIT

Repo

https://github.com/vyperlang/vyper

Events

Introduced

6fb750af3972160f871f62bb49a44827acf06423

Last Affected

577d2534356903076bb79b5b15ebd4d772994693

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0.4.0b1"
                },
                {
                    "last_affected":  "0.5.0b1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Affected versions

v0.*

v0.4.0

v0.4.0b1

v0.4.0b2

v0.4.0b3

v0.4.0b4

v0.4.0b5

v0.4.0b6

v0.4.0rc1

v0.4.0rc2

v0.4.0rc3

v0.4.0rc4

v0.4.0rc5

v0.4.0rc6

v0.4.1

v0.4.1b1

v0.4.1b2

v0.4.1b3

v0.4.1b4

v0.4.1rc1

v0.4.1rc2

v0.4.1rc3

v0.4.2

v0.4.2rc1

v0.4.3

v0.4.3rc1

v0.5.0a1

v0.5.0a2

v0.5.0a3

v0.5.0b1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114663.json"