vyperlang has 8 CVEs on record. Disclosure cadence is accelerating: 8 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 8. The median CVSS is 5.3 (medium). None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.3
- Publish → KEV
- —
- Last 90 days
- 8 prev 0
Worst active — by depth score
CVE-2026-114663High· 8.4Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments46CVE-2026-114117Medium· 5.9Vyper 0.3.8 through 0.5.0b1 Optimizer Miscompilation of msg.value | K in Ternary Branches45CVE-2020-37286Medium· 6.5Vyper 0.1.0b4 before 0.3.0 Memory Corruption via Nested Internal Function Calls36CVE-2026-114116Medium· 5.3Vyper through 0.5.0b1 Literal Value Manipulation via Line Separators29CVE-2026-114114Medium· 5.3Vyper through 0.5.0b1 Literal Value Substitution via Multi-byte Characters29
vyperlang vulnerabilities
CVEs affecting vyperlang, newest first. Open any entry for full detail, references, and exploit status.
8 CVEsRSS
CVE-2026-114663High· 8.4Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments
Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's param…
CVE-2020-37286Medium· 6.5Vyper 0.1.0b4 before 0.3.0 Memory Corruption via Nested Internal Function Calls
Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested calls. Contracts using such calls as tuple elements, call arg…
CVE-2021-48019Medium· 4.8Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies
Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data whe…
CVE-2026-114114Medium· 5.3Vyper through 0.5.0b1 Literal Value Substitution via Multi-byte Characters
Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct la…
CVE-2026-114117Medium· 5.9PoCVyper 0.3.8 through 0.5.0b1 Optimizer Miscompilation of msg.value | K in Ternary Branches
Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas…
CVE-2026-114116Medium· 5.3Vyper through 0.5.0b1 Literal Value Manipulation via Line Separators
Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified an…
CVE-2026-114115Low· 3.7Vyper 0.3.8 through 0.5.0b1 Memory Misread via Ternary Nested Array Selection
Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that reads nested arrays with narrower inner bounds using the wider result type's memory layout. When a ternary selects the narrower array, inner…
CVE-2026-114118Medium· 4.8Vyper 0.3.4 through 0.5.0b1 create_from_blueprint Offset Validation Bypass via Unsigned Wraparound
Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by uint256 subtraction without first checking that code_offset is below the blueprint's code size, so a huge offset wraps to a small positive valu…