CVE-2026-114663Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments

Açıklama

Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name, attacker-influenced input can replace the intended value, including out-of-range values for narrow types such as uint8, corrupting validation or accounting logic.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• GitHub Security Advisory (GHSA-2489-32vh-8rrc) vendor-advisory
• VulnCheck Advisory: Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments third-party-advisory