CVE-2026-114663 Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-114663?
CVE-2026-114663 is a high-severity vulnerability in vyperlang vyper, published on 22 Oct 2026.
Official description
Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name, attacker-influenced input can replace the intended value, including out-of-range values for narrow types such as uint8, corrupting validation or accounting logic.
Weakness: CWE-706
Which versions are affected by CVE-2026-114663?
How do I fix CVE-2026-114663?
No fix has been published for CVE-2026-114663 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-114663 being exploited?
There is no known exploitation of CVE-2026-114663 in the wild and no public exploit code.
Sources
Also known as GHSA-2489-32vh-8rrc, GHSA-9r8w-599f-g6jq.