Read the docs
TI-2026-78729 Aliases CVE-2026-114116

Vyper misreads numeric literals when source has line separators

Priority MEDIUM 60CWE-436Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Vyper from 0.1.0b1 before 0.1.0b17 and from 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(). Characters such as form feed and U+2028 count as line breaks there but not in the Python parser, so numeric literals are validated from shifted source text (CWE-436). An attacker who contributes source code can hide these characters in comments, strings or indentation to silently change address, integer or decimal constants.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker contributing source code can hide these characters in comments, strings or indentation to silently change address, integer or decimal constants.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0026 17th percentileScored 2026-11-07
Fix Fixed vyper (vyperlang): 0.1.0b17

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
vyperlangvyper0.1.0b1 to before 0.1.0b170.1.0b17Patch availableCNA
vyperlangvyper0.4.1 – 0.5.0b1—No fix listedCNA
  • vyper Vendorvyperlang Affected 0.1.0b1 to before 0.1.0b17 Fixed in 0.1.0b17 Patch available CNA
  • vyper Vendorvyperlang Affected 0.4.1 – 0.5.0b1 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*——vyperlang
  • cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:* Versions — — ·vyperlang

Remediation

Upgrade Vyper 0.1.0b1 through 0.1.0b16 to 0.1.0b17. No fixed version is listed for Vyper 0.4.1 through 0.5.0b1.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

  • Fix · CNA vyper (vyperlang) Fixed in 0.1.0b17

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-114116
  2. 2026-10-22 Priority changed: MEDIUM → LOW
  3. 2026-10-28 CISA SSVC decision points changed
  4. 2026-10-28 Priority changed: LOW → MEDIUM
  5. 2026-11-02 Affected versions changed · Red Hat
  6. 2026-11-02 CVSS score added · Red Hat

References

Advisory 1

  • TI-2024-16182 Vyper bounds check on built-in `slice()` function can be overflowed CVSS 3.1CRITICAL 9.8
  • TI-2024-14992 concat built-in can corrupt memory in vyper CVSS 3.1CRITICAL 9.8
  • TI-2024-16184 Vyper array negative index vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2022-08657 Integer bounds error in Vyper CVSS 3.1CRITICAL 9.8
  • TI-2022-11796 Multiple evaluation of contract address in call in vyper CVSS 3.1HIGH 8.2
  • TI-2026-78730 Optimizer miscompilation of msg.value | K in Vyper ternary branches CVSS 4.0HIGH 8.2
See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences