Bug 2557977 (CVE-2026-114116)

Summary: CVE-2026-114116 vyper: Vyper: Constant value manipulation via line separator discrepancy
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Vyper. An attacker contributing source code can manipulate constant values in compiled contracts by embedding non-standard line-break characters into comments, strings, or indentation. Because the compiler interprets these line breaks differently from the underlying language parser, source text positions shift during validation. This flaw allows an attacker to silently alter critical values, such as financial amounts or account addresses, without detection during visual code inspection.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2565613    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-21 00:56:24 UTC 
Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker contributing source code can hide these characters in comments, strings or indentation to silently change address, integer or decimal constants.