CVE-2026-2887

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-2887
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2887.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-2887
Published
2026-02-21T21:02:16Z
Modified
2026-10-28T10:58:12Z
Severity
  • 1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
aardappel lobster idents.h TypeName recursion
Details

A security vulnerability has been detected in aardappel lobster up to 2025.4. This impacts the function lobster::TypeName in the library dev/src/lobster/idents.h. Such manipulation leads to uncontrolled recursion. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. Upgrading to version 2026.1 will fix this issue. The name of the patch is 8ba49f98ccfc9734ef352146806433a41d9f9aa6. It is advisable to upgrade the affected component.

Database specific 
{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-404",
        "CWE-674"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2887.json"
}
References

Affected packages

Git / github.com/aardappel/lobster

Affected ranges

Type
GIT
Repo
https://github.com/aardappel/lobster
Events
Introduced
3099fed70556742a460cf902239da20e0a3beb3f
Fixed
8ba49f98ccfc9734ef352146806433a41d9f9aa6
Fixed
3b836b0cbc78e60e141ace8d542e9a9104ba09d6
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "2025.0"
                },
                {
                    "last_affected":  "2025.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "2025.1"
                },
                {
                    "last_affected":  "2025.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "2025.2"
                },
                {
                    "last_affected":  "2025.2"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "2025.3"
                },
                {
                    "last_affected":  "2025.3"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "2025.4"
                },
                {
                    "last_affected":  "2025.4"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "fixed":  "8ba49f98ccfc9734ef352146806433a41d9f9aa6"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v2026.1",
            "range":  [
                {
                    "fixed":  "3b836b0cbc78e60e141ace8d542e9a9104ba09d6"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

2025.*
2025.0
2025.1
2025.2
2025.3
2025.4
v2025.*
v2025.0
v2025.1
v2025.2
v2025.3
v2025.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2887.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "46575019343674773079592891836700580419",
                "140957871207935101347065596290055151900",
                "307454845477534070013514563560008981795",
                "156206073999728553437417812430121194787",
                "26366910463825801029808292025907054425",
                "44081168939887787255690584213383282136",
                "164060763093415941512973146615891201945"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-2887-0225601b",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/aardappel/lobster/commit/3b836b0cbc78e60e141ace8d542e9a9104ba09d6",
        "target":  {
            "file":  "dev/src/cubegen.cpp"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "227256009737831955003652810342855212930",
            "length":  695
        },
        "id":  "CVE-2026-2887-351fbdaa",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/aardappel/lobster/commit/8ba49f98ccfc9734ef352146806433a41d9f9aa6",
        "target":  {
            "file":  "dev/src/lobster/idents.h",
            "function":  "Signature"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "304735064974996089197437057321316634312",
            "length":  207
        },
        "id":  "CVE-2026-2887-43ffdedc",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/aardappel/lobster/commit/8ba49f98ccfc9734ef352146806433a41d9f9aa6",
        "target":  {
            "file":  "dev/src/lobster/idents.h",
            "function":  "FormatArg"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "244345584280510524599917864350125512012",
            "length":  46679
        },
        "id":  "CVE-2026-2887-7b45e0a5",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/aardappel/lobster/commit/3b836b0cbc78e60e141ace8d542e9a9104ba09d6",
        "target":  {
            "file":  "dev/src/cubegen.cpp",
            "function":  "AddCubeGen"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "239285765949067322934000454844632100450",
                "255414495538908661679616648510982195011",
                "42341475388920069817670342920815999538",
                "178862988535679397526097919904432123089",
                "156699660187721883065542877800659225051",
                "261858868297470446191411222917717725831",
                "210771999694009721627437620600580089790",
                "262364797402027718454847673472575549763",
                "252612480201001246305163764941293131905",
                "100802621910838096123150085647102856200",
                "101028120425351004949830447943062934949",
                "236790058042619412715886644912928041805",
                "320235971895888576163121118529691898255",
                "168132076775143415204139068268986705884",
                "273322370637900829667704392279421085075",
                "131123933948446315047232450613911719490",
                "117534529330063369351032184911384081525",
                "220772955914040545923870893234207429178",
                "137181657716500234434816501014549634082",
                "222317656039368419673983645501651662223",
                "140465037631558303983870157552533069719",
                "250322304510398223721354105837728160555",
                "84032017230860419237061467325150760138",
                "237149293700460480486824881170613787880",
                "86558722907637743510303273568253903975",
                "21548386190080236272585248586979758462",
                "202365070927892080822389782152905888088",
                "10174440567302396702137861459953192437",
                "333087856393019103838150273657476354460"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-2887-d1c77cf0",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/aardappel/lobster/commit/8ba49f98ccfc9734ef352146806433a41d9f9aa6",
        "target":  {
            "file":  "dev/src/lobster/idents.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "13120769581792069296149603048850509738",
            "length":  1956
        },
        "id":  "CVE-2026-2887-edcec441",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/aardappel/lobster/commit/8ba49f98ccfc9734ef352146806433a41d9f9aa6",
        "target":  {
            "file":  "dev/src/lobster/idents.h",
            "function":  "TypeName"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T10:58:12Z"