Bug 2565613

Summary: CVE-2026-114116 vyper: Vyper: Constant value manipulation via line separator discrepancy [fedora-all]
Product: [Fedora] Fedora Reporter: TEJ RATHI <trathi>
Component: vyperAssignee: Peter Lemenkov <lemenkov>
Status: ON_QA --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: rawhideCC: lemenkov
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["8a597538-7c98-47d9-947e-4a8e2582b063"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2557977    

Description TEJ RATHI 2026-11-03 07:36:40 UTC
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker contributing source code can hide these characters in comments, strings or indentation to silently change address, integer or decimal constants.

Comment 1 Fedora Update System 2026-11-03 07:43:37 UTC
FEDORA-2026-d7d3016c54 (vyper-0.4.3-9.fc45) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-d7d3016c54

Comment 2 Fedora Update System 2026-11-03 07:43:40 UTC
FEDORA-2026-9e904c3eb3 (vyper-0.4.3-9.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-9e904c3eb3

Comment 3 Fedora Update System 2026-11-03 07:43:45 UTC
FEDORA-2026-a6f4884fd9 (vyper-0.4.3-9.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-a6f4884fd9

Comment 4 Fedora Update System 2026-11-04 02:44:32 UTC
FEDORA-2026-9e904c3eb3 has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-9e904c3eb3`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-9e904c3eb3

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 5 Fedora Update System 2026-11-04 03:08:53 UTC
FEDORA-2026-a6f4884fd9 has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-a6f4884fd9`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-a6f4884fd9

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 6 Fedora Update System 2026-11-04 03:34:49 UTC
FEDORA-2026-d7d3016c54 has been pushed to the Fedora 45 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-d7d3016c54`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-d7d3016c54

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.