Bug 2559184

Summary: CVE-2026-114663 vyper: Vyper: Contract logic corruption via improper name resolution of imported constants [fedora-43]
Product: [Fedora] Fedora Reporter: Srikanth Balasubramanian <sbalasub>
Component: vyperAssignee: Peter Lemenkov <lemenkov>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: 43CC: lemenkov
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["2c564f4c-10ae-44bc-ad16-a53e2850ef22"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2558736    

Description Srikanth Balasubramanian 2026-10-22 17:30:08 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name, attacker-influenced input can replace the intended value, including out-of-range values for narrow types such as uint8, corrupting validation or accounting logic.