CVE-2026-114117

A flaw was found in Vyper. A remote attacker can cause smart contracts to execute with incorrect values due to an optimizer miscompilation. When compiling conditional branches containing certain bitwise operations under default optimization settings, the compiler incorrectly reduces the expressio...

CVE-2021-48020

A flaw was found in Vyper. When compiling contracts that execute internal function calls inside array structures or nested elements, an incorrect stack pointer is used. A remote attacker interacting with an affected contract can trigger memory corruption, resulting in unexpected contract executio...

CVE-2021-48018

A flaw was found in Vyper. The compiler improperly assigns storage locations for reentrancy locks—safeguards designed to prevent repeated, recursive execution—to the same memory slots as contract variables. When an external caller invokes a protected function, setting the lock overwrites existing...

CVE-2020-37288

A flaw was found in Vyper. A remote attacker can cause a Denial of Service DoS against affected smart contracts by submitting transactions that invoke specific contract functions. Due to incorrect bytecode generation for return statements located inside loops within nested internal calls, the...

CVE-2026-114116

A flaw was found in Vyper. An attacker contributing source code can manipulate constant values in compiled contracts by embedding non-standard line-break characters into comments, strings, or indentation. Because the compiler interprets these line breaks differently from the underlying language...

CVE-2026-114115

A flaw was found in Vyper. The compiler improperly calculates memory offsets when handling conditional ternary expressions that select between nested arrays with mismatched dimensions. A remote user interacting with an affected smart contract can trigger this condition, causing the contract to re...

CVE-2020-37289

A flaw was found in Vyper. The compiler does not validate the upper bounds of smaller integer types returned from external contract interfaces, allowing 8-bit values to be stored in larger 256-bit variables without range verification. A malicious smart contract can exploit this flaw by returning...

CVE-2021-48019

A flaw was found in Vyper. Forwarder proxies created using the built-in createforwarderto function report a fixed return data size instead of the actual data length returned by the target contract. A remote caller or interacting smart contract can encounter data corruption when returned payloads...

CVE-2020-37286

A flaw was found in vyper. An incorrect stack pointer calculation occurs when internal function calls are evaluated within tuples or nested calls, leading to memory corruption in compiled contracts. A remote caller interacting with an affected smart contract can exploit this issue to produce...

CVE-2020-37287

A flaw was found in vyper. An attacker interacting with an affected smart contract can cause data corruption and incorrect execution when functions process complex data types, such as multi-dimensional arrays or nested structures. The compiler incorrectly calculates the memory size of these compl...

CVE-2026-114663

A flaw was found in Vyper. The compiler incorrectly resolves imported constants and default arguments within a function's local scope rather than at their original declaration. If a smart contract uses a local variable or parameter that shares a name with an imported identifier, an attacker...

CVE-2026-114663

Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parseName resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name,...

CVE-2026-114663 Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments

Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parseName resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name,...

EUVD-2026-107698

Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parseName resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name,...

CVE-2026-114663

Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parseName resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name,...

CVE-2026-114663 Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments

Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parseName resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name,...

CVE-2026-114663

Vyper versions 0.4.0b1 through 0.5.0b1 are vulnerable to a name shadowing issue affecting unfoldable constants and omitted default arguments from imported modules. The root cause is that the parse_Name function resolves these names within the using function's scope instead of at the point of decl...

CVE-2026-114663 Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments

Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parseName resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name,...

PT-2026-120945

Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name,...

CVE-2026-114114

A flaw was found in Vyper. The compiler improperly calculates source code positions by mixing character-based offsets with byte offsets during parsing. An attacker contributing source code can exploit this flaw by introducing multi-byte characters or invisible markers to shift internal code...