Bug 2565613 - CVE-2026-114116 vyper: Vyper: Constant value manipulation via line separator discrepancy [fedora-all]
Summary: CVE-2026-114116 vyper: Vyper: Constant value manipulation via line separator ...
Keywords:
Status: ON_QA
Alias: None
Product: Fedora
Classification: Fedora
Component: vyper
Version: rawhide
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ---
Assignee: Peter Lemenkov
QA Contact:
URL:
Whiteboard: {"flaws": ["8a597538-7c98-47d9-947e-4...
Depends On:
Blocks: CVE-2026-114116
TreeView+ depends on / blocked
 
Reported: 2026-11-03 07:36 UTC by TEJ RATHI
Modified: 2026-11-04 03:34 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Type: ---
Embargoed:


Attachments (Terms of Use)

Description TEJ RATHI 2026-11-03 07:36:40 UTC
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker contributing source code can hide these characters in comments, strings or indentation to silently change address, integer or decimal constants.

Comment 1 Fedora Update System 2026-11-03 07:43:37 UTC
FEDORA-2026-d7d3016c54 (vyper-0.4.3-9.fc45) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-d7d3016c54

Comment 2 Fedora Update System 2026-11-03 07:43:40 UTC
FEDORA-2026-9e904c3eb3 (vyper-0.4.3-9.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-9e904c3eb3

Comment 3 Fedora Update System 2026-11-03 07:43:45 UTC
FEDORA-2026-a6f4884fd9 (vyper-0.4.3-9.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-a6f4884fd9

Comment 4 Fedora Update System 2026-11-04 02:44:32 UTC
FEDORA-2026-9e904c3eb3 has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-9e904c3eb3`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-9e904c3eb3

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 5 Fedora Update System 2026-11-04 03:08:53 UTC
FEDORA-2026-a6f4884fd9 has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-a6f4884fd9`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-a6f4884fd9

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 6 Fedora Update System 2026-11-04 03:34:49 UTC
FEDORA-2026-d7d3016c54 has been pushed to the Fedora 45 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-d7d3016c54`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-d7d3016c54

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.


Note You need to log in before you can comment on or make changes to this bug.