{"id":"CVE-2026-114663","revision":"c738317209314584855205591d2ad73d","records":[{"revision":"c738317209314584855205591d2ad73d","observedAt":"2026-10-23T16:48:20.594+00:00","statement":{"source":"cve-program","id":"CVE-2026-114663","aliases":[],"title":"Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments","description":"Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name, attacker-influenced input can replace the intended value, including out-of-range values for narrow types such as uint8, corrupting validation or accounting logic.","state":0,"publishedAt":"2026-10-22T01:43:46.942+00:00","modifiedAt":"2026-10-23T15:06:28.237+00:00","affected":[{"ecosystem":"Vendor product","name":"vyper","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"vyperlang\",\n                    \"product\": \"vyper\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:pypi/vyper\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0.4.0b1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"python\",\n                            \"lessThanOrEqual\": \"0.5.0b1\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":8.6,"severity":"HIGH"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.4,"severity":"HIGH"}],"references":["https://github.com/vyperlang/vyper/security/advisories/GHSA-2489-32vh-8rrc","https://www.vulncheck.com/advisories/vyper-0.4-0b1-through-0.5-0b1-name-shadowing-of-imported-constants-and-default-arguments"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-114663","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-114663","identifiers":["CVE-2026-114663"]},"retained":false,"historicalAffected":[]}],"coverage":[]}