CVE-2026-114116

Deferred Deferred - Pending Action

Vyper Integer Validation Bypass via Source-Line Manipulation

Publication date: 2026-10-21

Last updated on: 2026-10-28

Assigner: VulnCheck

Description

Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker contributing source code can hide these characters in comments, strings or indentation to silently change address, integer or decimal constants.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-114116

EUVD

EUVD-2026-106919

Affected Vendors & Products

Vendor	Product	Version / Range
vyperlang	vyper	0.1.0b1
vyperlang	vyper	0.4.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-436	Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Vyper programming language compiler. It occurs because Vyper's source-line table uses str.splitlines() to process code, which treats additional characters like form feed and U+2028 as line breaks. Python's parser ignores these characters, causing a mismatch. Attackers can insert these hidden line separators in comments, strings, or indentation to shift numeric literals, altering their values without detection.

Detection Guidance

To detect this vulnerability, inspect Vyper source code for hidden line separators like form feed or U+2028 in comments, strings, or indentation. Use tools like grep to search for these characters: grep -P '[\f\x{2028}]' your_contract.vy. Check Vyper version with vyper --version to confirm if affected versions (>=0.1.0b1, <0.1.0b17 or >=0.4.1, <=0.5.0b1) are in use.

Impact Analysis

An attacker could exploit this to silently change constants like addresses or integers in smart contracts. This might redirect funds, alter contract behavior, or cause unexpected execution. Developers using vulnerable Vyper versions may unknowingly deploy contracts with incorrect logic due to altered numeric values.

Compliance Impact

This vulnerability primarily affects software development and deployment processes rather than direct compliance with standards like GDPR or HIPAA. The issue could lead to incorrect numeric literals in smart contracts, potentially causing unintended behavior or security flaws that might violate compliance requirements indirectly if contracts fail to meet regulatory obligations due to altered constants.

Mitigation Strategies

Upgrade Vyper to a patched version if available. Avoid using vulnerable versions (>=0.1.0b1, <0.1.0b17 or >=0.4.1, <=0.5.0b1). Review and sanitize source code to remove hidden line separators. Use alternative compilers or manual code audits to verify numeric literals.

Hi! I’m here to help you understand CVE-2026-114116. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...