CVE-2026-114663

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-114663", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-21T21:59:05.257Z", "datePublished": "2026-10-22T01:43:46.942Z", "dateUpdated": "2026-10-23T15:06:28.237Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-22T01:43:46.942Z"}, "datePublic": "2026-10-07T00:00:00.000Z", "title": "Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments", "descriptions": [{"lang": "en", "value": "Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name, attacker-influenced input can replace the intended value, including out-of-range values for narrow types such as uint8, corrupting validation or accounting logic."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Use of Incorrectly-Resolved Name or Reference", "cweId": "CWE-706", "type": "CWE"}]}], "affected": [{"vendor": "vyperlang", "product": "vyper", "defaultStatus": "unaffected", "packageURL": "pkg:pypi/vyper", "versions": [{"version": "0.4.0b1", "status": "affected", "versionType": "python", "lessThanOrEqual": "0.5.0b1"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*", "versionStartIncluding": "0.4.0b1", "versionEndIncluding": "0.5.0b1"}]}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 8.6, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS"}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "references": [{"url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-2489-32vh-8rrc", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-2489-32vh-8rrc)"}, {"name": "VulnCheck Advisory: Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/vyper-0.4-0b1-through-0.5-0b1-name-shadowing-of-imported-constants-and-default-arguments"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-23T14:54:17.794694Z", "id": "CVE-2026-114663", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-23T15:06:28.237Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-114663", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-21T21:59:05.257Z", "datePublished": "2026-10-22T01:43:46.942Z", "dateUpdated": "2026-10-23T15:06:28.237Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-22T01:43:46.942Z"}, "datePublic": "2026-10-07T00:00:00.000Z", "title": "Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments", "descriptions": [{"lang": "en", "value": "Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name, attacker-influenced input can replace the intended value, including out-of-range values for narrow types such as uint8, corrupting validation or accounting logic."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Use of Incorrectly-Resolved Name or Reference", "cweId": "CWE-706", "type": "CWE"}]}], "affected": [{"vendor": "vyperlang", "product": "vyper", "defaultStatus": "unaffected", "packageURL": "pkg:pypi/vyper", "versions": [{"version": "0.4.0b1", "status": "affected", "versionType": "python", "lessThanOrEqual": "0.5.0b1"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*", "versionStartIncluding": "0.4.0b1", "versionEndIncluding": "0.5.0b1"}]}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 8.6, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS"}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "references": [{"url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-2489-32vh-8rrc", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-2489-32vh-8rrc)"}, {"name": "VulnCheck Advisory: Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/vyper-0.4-0b1-through-0.5-0b1-name-shadowing-of-imported-constants-and-default-arguments"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-114663", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-23T14:54:17.794694Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-23T14:54:18.506Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:pypi/vyper", "product": "vyper", "vendor": "vyperlang", "versions": [{"lessThanOrEqual": "0.5.0b1", "status": "affected", "version": "0.4.0b1", "versionType": "python"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name, attacker-influenced input can replace the intended value, including out-of-range values for narrow types such as uint8, corrupting validation or accounting logic."}], "id": "CVE-2026-114663", "lastModified": "2026-10-23T15:17:27.677", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-114663", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-23T14:54:17.794694Z", "version": "2.0.3"}}]}, "published": "2026-10-22T02:16:58.603", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-2489-32vh-8rrc"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/vyper-0.4-0b1-through-0.5-0b1-name-shadowing-of-imported-constants-and-default-arguments"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-706"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "vyper: Vyper: Contract logic corruption via improper name resolution of imported constants", "id": "2558736", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558736"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-694", "details": ["A flaw was found in Vyper. The compiler incorrectly resolves imported constants and default arguments within a function's local scope rather than at their original declaration. If a smart contract uses a local variable or parameter that shares a name with an imported identifier, an attacker interacting with the contract can override intended constant values with arbitrary input. This issue can lead to bypassed security validation and corrupted accounting logic in affected smart contracts."], "name": "CVE-2026-114663", "public_date": "2026-10-22T01:43:46Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-114663\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-114663\nhttps://github.com/vyperlang/vyper/security/advisories/GHSA-2489-32vh-8rrc\nhttps://www.vulncheck.com/advisories/vyper-0.4-0b1-through-0.5-0b1-name-shadowing-of-imported-constants-and-default-arguments"], "statement": "This vulnerability is rated as Important rather than Critical because exploitation is limited to contract builds where function-scoped parameters directly collide with imported identifiers, requiring specific code patterns to manifest. In Red Hat environments, the Vyper compiler is not included or supported in Red Hat Enterprise Linux releases and is only available through community Fedora repositories. For systems utilizing the compiler locally, the miscompilation can lead to high integrity and availability compromises in deployed contracts by allowing unexpected input to bypass internal safeguards.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0.4.0b1,0.5.0b1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "vyper", "source": "cna", "vendor": "vyperlang"}, "product": "vyper", "vendor": "vyperlang"}], "created": "2026-10-22T07:15:14.837272+00:00", "updated": "2026-10-23T04:45:14.352376+00:00", "vendors": ["vyperlang", "vyperlang$PRODUCT$vyper"]}