CVE Feed

    Dashboard / CVE / CVE-2026-114116

    CVE-2026-114116

    Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker contributing source code can hide these characters in comments, strings or indentation to silently change address, integer or decimal constants.

    Published:Oct 21, 2026
    Last Modified:Oct 28, 2026
    EPS:Oct 21, 2026
    EPSS Score:0.00183
    CVSS Score:5.3

    Affected Products

    Vendor
    Vyperlang
    Product
    Vyper

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-436 Interpretation Conflict

    Related CVEs

    CVE-2026-114663 (CVSS 8.6) — Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported mod…
    CVE-2026-114118 (CVSS 6.3) — Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by uint256 subtract…
    CVE-2026-114117 (CVSS 8.2) — Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | …
    CVE-2026-114115 (CVSS 6.3) — Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that reads nested …
    CVE-2026-114114 (CVSS 6) — Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Pytho…
    CVE-2021-48020 (CVSS 8.3) — Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip po…
    CVE-2021-48019 (CVSS 6.3) — Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a f…
    CVE-2021-48018 (CVSS 8.3) — Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locatio…
    CVE-2020-37289 (CVSS 6.3) — Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decim…
    CVE-2020-37288 (CVSS 6.3) — Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an inter…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High