{"id":"CVE-2026-114663","summary":"Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments","details":"Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name, attacker-influenced input can replace the intended value, including out-of-range values for narrow types such as uint8, corrupting validation or accounting logic.","aliases":["GHSA-2489-32vh-8rrc"],"modified":"2026-10-22T10:46:12.406611148Z","published":"2026-10-22T01:43:46.942Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114663.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-706"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114663.json"},{"type":"ADVISORY","url":"https://github.com/vyperlang/vyper/security/advisories/GHSA-2489-32vh-8rrc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114663"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/vyper-0.4-0b1-through-0.5-0b1-name-shadowing-of-imported-constants-and-default-arguments"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/vyperlang/vyper","events":[{"introduced":"6fb750af3972160f871f62bb49a44827acf06423"},{"last_affected":"577d2534356903076bb79b5b15ebd4d772994693"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"0.4.0b1"},{"last_affected":"0.5.0b1"}]}]}}],"versions":["v0.5.0b1","v0.5.0a3","v0.5.0a2","v0.5.0a1","v0.4.3","v0.4.3rc1","v0.4.2","v0.4.2rc1","v0.4.1","v0.4.1rc3","v0.4.1rc2","v0.4.1rc1","v0.4.1b4","v0.4.1b3","v0.4.1b2","v0.4.1b1","v0.4.0","v0.4.0rc6","v0.4.0rc5","v0.4.0rc4","v0.4.0rc3","v0.4.0rc2","v0.4.0rc1","v0.4.0b6","v0.4.0b5","v0.4.0b4","v0.4.0b3","v0.4.0b2","v0.4.0b1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114663.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}