CVE-2026-114116

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-114116", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-20T21:48:58.503Z", "datePublished": "2026-10-21T00:37:13.988Z", "dateUpdated": "2026-10-28T13:48:11.399Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-21T00:37:13.988Z"}, "datePublic": "2026-10-06T00:00:00.000Z", "title": "Vyper through 0.5.0b1 Literal Value Manipulation via Line Separators", "descriptions": [{"lang": "en", "value": "Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker contributing source code can hide these characters in comments, strings or indentation to silently change address, integer or decimal constants."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Interpretation Conflict", "cweId": "CWE-436", "type": "CWE"}]}], "affected": [{"vendor": "vyperlang", "product": "vyper", "defaultStatus": "unaffected", "packageURL": "pkg:pypi/vyper", "versions": [{"version": "0.1.0b1", "status": "affected", "versionType": "python", "lessThan": "0.1.0b17"}, {"version": "0.1.0b17", "status": "unaffected", "versionType": "python"}]}, {"vendor": "vyperlang", "product": "vyper", "defaultStatus": "unaffected", "packageURL": "pkg:pypi/vyper", "versions": [{"version": "0.4.1", "status": "affected", "versionType": "python", "lessThanOrEqual": "0.5.0b1"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*", "versionStartIncluding": "0.1.0b1", "versionEndExcluding": "0.1.0b17"}]}]}, {"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*", "versionStartIncluding": "0.4.1", "versionEndIncluding": "0.5.0b1"}]}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 6, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS"}, {"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "format": "CVSS"}], "references": [{"url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-wvx7-39qj-2g9v", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-wvx7-39qj-2g9v)"}, {"name": "VulnCheck Advisory: Vyper through 0.5.0b1 Literal Value Manipulation via Line Separators", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/vyper-through-0.5-0b1-literal-value-manipulation-via-line-separators"}], "credits": [{"lang": "en", "value": "DELENE-TCHIO-ROMUALD", "type": "reporter"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-wvx7-39qj-2g9v", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-28T13:47:49.890228Z", "id": "CVE-2026-114116", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-28T13:48:11.399Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-114116", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-28T13:47:49.890228Z"}}}], "references": [{"url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-wvx7-39qj-2g9v", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-28T13:48:07.228Z"}}], "cna": {"title": "Vyper through 0.5.0b1 Literal Value Manipulation via Line Separators", "credits": [{"lang": "en", "type": "reporter", "value": "DELENE-TCHIO-ROMUALD"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "vyperlang", "product": "vyper", "versions": [{"status": "affected", "version": "0.1.0b1", "lessThan": "0.1.0b17", "versionType": "python"}, {"status": "unaffected", "version": "0.1.0b17", "versionType": "python"}], "packageURL": "pkg:pypi/vyper", "defaultStatus": "unaffected"}, {"vendor": "vyperlang", "product": "vyper", "versions": [{"status": "affected", "version": "0.4.1", "versionType": "python", "lessThanOrEqual": "0.5.0b1"}], "packageURL": "pkg:pypi/vyper", "defaultStatus": "unaffected"}], "datePublic": "2026-10-06T00:00:00.000Z", "references": [{"url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-wvx7-39qj-2g9v", "name": "GitHub Security Advisory (GHSA-wvx7-39qj-2g9v)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/vyper-through-0.5-0b1-literal-value-manipulation-via-line-separators", "name": "VulnCheck Advisory: Vyper through 0.5.0b1 Literal Value Manipulation via Line Separators", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker contributing source code can hide these characters in comments, strings or indentation to silently change address, integer or decimal constants."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-436", "description": "Interpretation Conflict"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "0.1.0b17", "versionStartIncluding": "0.1.0b1"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "0.5.0b1", "versionStartIncluding": "0.4.1"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-21T00:37:13.988Z"}}}, "cveMetadata": {"cveId": "CVE-2026-114116", "state": "PUBLISHED", "dateUpdated": "2026-10-28T13:48:11.399Z", "dateReserved": "2026-10-20T21:48:58.503Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-21T00:37:13.988Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:pypi/vyper", "product": "vyper", "vendor": "vyperlang", "versions": [{"lessThan": "0.1.0b17", "status": "affected", "version": "0.1.0b1", "versionType": "python"}, {"status": "unaffected", "version": "0.1.0b17", "versionType": "python"}]}, {"defaultStatus": "unaffected", "packageURL": "pkg:pypi/vyper", "product": "vyper", "vendor": "vyperlang", "versions": [{"lessThanOrEqual": "0.5.0b1", "status": "affected", "version": "0.4.1", "versionType": "python"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker contributing source code can hide these characters in comments, strings or indentation to silently change address, integer or decimal constants."}], "id": "CVE-2026-114116", "lastModified": "2026-10-28T14:16:57.630", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-114116", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-28T13:47:49.890228Z", "version": "2.0.3"}}]}, "published": "2026-10-21T01:17:37.930", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-wvx7-39qj-2g9v"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/vyper-through-0.5-0b1-literal-value-manipulation-via-line-separators"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-wvx7-39qj-2g9v"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-436"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "vyper: Vyper: Constant value manipulation via line separator discrepancy", "id": "2557977", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557977"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-115", "details": ["Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker contributing source code can hide these characters in comments, strings or indentation to silently change address, integer or decimal constants.", "A flaw was found in Vyper. An attacker contributing source code can manipulate constant values in compiled contracts by embedding non-standard line-break characters into comments, strings, or indentation. Because the compiler interprets these line breaks differently from the underlying language parser, source text positions shift during validation. This flaw allows an attacker to silently alter critical values, such as financial amounts or account addresses, without detection during visual code inspection."], "name": "CVE-2026-114116", "public_date": "2026-10-21T00:37:13Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-114116\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-114116\nhttps://github.com/vyperlang/vyper/security/advisories/GHSA-wvx7-39qj-2g9v\nhttps://www.vulncheck.com/advisories/vyper-through-0.5-0b1-literal-value-manipulation-via-line-separators"], "statement": "This vulnerability is rated as Moderate impact for Red Hat because successful exploitation requires an adversary to introduce specifically crafted source code and have a user or automated pipeline compile it. While the integrity consequences could be significant if altered constants are deployed in compiled artifacts, execution requires local user interaction and code contribution privileges rather than remote unauthenticated access. Furthermore, Vyper is not distributed with Red Hat Enterprise Linux, limiting the direct impact on Red Hat products.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0.1.0b1,0.1.0b17)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "0.1.0b17"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "vyper", "source": "cna", "vendor": "vyperlang"}, "product": "vyper", "vendor": "vyperlang"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0.4.1,0.5.0b1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "vyper", "source": "cna", "vendor": "vyperlang"}, "product": "vyper", "vendor": "vyperlang"}], "created": "2026-10-21T15:30:10.737252+00:00", "updated": "2026-11-02T14:00:08.966245+00:00", "vendors": ["vyperlang", "vyperlang$PRODUCT$vyper"]}