VyperLang Vyper up to 0.5.0b1 Name Resolution parse_Name missing reference to active file descriptor or handle

Summaryinfo

A vulnerability was found in VyperLang Vyper up to 0.5.0b1. It has been classified as critical. This issue affects the function parse_Name of the component Name Resolution. This manipulation causes missing reference to active file descriptor or handle. This vulnerability appears as CVE-2026-114663. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability classified as critical was found in VyperLang Vyper up to 0.5.0b1. Affected by this vulnerability is the function parse_Name of the component Name Resolution. The manipulation with an unknown input leads to a missing reference to active file descriptor or handle vulnerability. The CWE definition for the vulnerability is CWE-773. The product does not properly maintain references to a file descriptor or handle, which prevents that file descriptor/handle from being reclaimed. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name, attacker-influenced input can replace the intended value, including out-of-range values for narrow types such as uint8, corrupting validation or accounting logic.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-114663 since 10/21/2026. The exploitation appears to be easy. The attack can be launched remotely. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/22/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• VyperLang

Name

• Vyper

Version

• 0.5.0b1

Website

• Product: https://github.com/vyperlang/vyper/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion