CVE-2026-2887

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-2887
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2887.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-2887
Published
2026-02-21T21:02:16.010Z
Modified
2026-07-18T03:58:35.994333Z
Severity
  • 1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
aardappel lobster idents.h TypeName recursion
Details

A security vulnerability has been detected in aardappel lobster up to 2025.4. This impacts the function lobster::TypeName in the library dev/src/lobster/idents.h. Such manipulation leads to uncontrolled recursion. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. Upgrading to version 2026.1 will fix this issue. The name of the patch is 8ba49f98ccfc9734ef352146806433a41d9f9aa6. It is advisable to upgrade the affected component.

Database specific 
{
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2887.json",
    "cwe_ids": [
        "CWE-404",
        "CWE-674"
    ]
}
References

Affected packages

Git / github.com/aardappel/lobster

Affected ranges

Type
GIT
Repo
https://github.com/aardappel/lobster
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3b836b0cbc78e60e141ace8d542e9a9104ba09d6
Fixed
8ba49f98ccfc9734ef352146806433a41d9f9aa6
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2026.1"
        }
    ],
    "cpe": "cpe:2.3:a:strlen:lobster:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

2025.*
2025.0
2025.1
2025.2
2025.3
2025.4
Other
before_namespace_change
last_coroutine
last_dynamically_typed
last_frame_log
last_interpreter
last_wasm_generator_enabled
lastruntimerefc
v2021.*
v2021.0
v2021.1
v2021.3
v2023.*
v2023.10
v2023.12
v2023.13
v2023.2
v2023.4
v2023.5
v2023.6
v2023.7
v2023.8
v2023.9
v2024.*
v2024.0
v2025.*
v2025.0
v2025.1
v2025.2
v2025.3
v2025.4

Database specific

vanir_signatures 
[
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "46575019343674773079592891836700580419",
                "140957871207935101347065596290055151900",
                "307454845477534070013514563560008981795",
                "156206073999728553437417812430121194787",
                "26366910463825801029808292025907054425",
                "44081168939887787255690584213383282136",
                "164060763093415941512973146615891201945"
            ]
        },
        "id": "CVE-2026-2887-0225601b",
        "signature_type": "Line",
        "source": "https://github.com/aardappel/lobster/commit/3b836b0cbc78e60e141ace8d542e9a9104ba09d6",
        "target": {
            "file": "dev/src/cubegen.cpp"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 695.0,
            "function_hash": "227256009737831955003652810342855212930"
        },
        "id": "CVE-2026-2887-351fbdaa",
        "signature_type": "Function",
        "source": "https://github.com/aardappel/lobster/commit/8ba49f98ccfc9734ef352146806433a41d9f9aa6",
        "target": {
            "function": "Signature",
            "file": "dev/src/lobster/idents.h"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 207.0,
            "function_hash": "304735064974996089197437057321316634312"
        },
        "id": "CVE-2026-2887-43ffdedc",
        "signature_type": "Function",
        "source": "https://github.com/aardappel/lobster/commit/8ba49f98ccfc9734ef352146806433a41d9f9aa6",
        "target": {
            "function": "FormatArg",
            "file": "dev/src/lobster/idents.h"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 46679.0,
            "function_hash": "244345584280510524599917864350125512012"
        },
        "id": "CVE-2026-2887-7b45e0a5",
        "signature_type": "Function",
        "source": "https://github.com/aardappel/lobster/commit/3b836b0cbc78e60e141ace8d542e9a9104ba09d6",
        "target": {
            "function": "AddCubeGen",
            "file": "dev/src/cubegen.cpp"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "239285765949067322934000454844632100450",
                "255414495538908661679616648510982195011",
                "42341475388920069817670342920815999538",
                "178862988535679397526097919904432123089",
                "156699660187721883065542877800659225051",
                "261858868297470446191411222917717725831",
                "210771999694009721627437620600580089790",
                "262364797402027718454847673472575549763",
                "252612480201001246305163764941293131905",
                "100802621910838096123150085647102856200",
                "101028120425351004949830447943062934949",
                "236790058042619412715886644912928041805",
                "320235971895888576163121118529691898255",
                "168132076775143415204139068268986705884",
                "273322370637900829667704392279421085075",
                "131123933948446315047232450613911719490",
                "117534529330063369351032184911384081525",
                "220772955914040545923870893234207429178",
                "137181657716500234434816501014549634082",
                "222317656039368419673983645501651662223",
                "140465037631558303983870157552533069719",
                "250322304510398223721354105837728160555",
                "84032017230860419237061467325150760138",
                "237149293700460480486824881170613787880",
                "86558722907637743510303273568253903975",
                "21548386190080236272585248586979758462",
                "202365070927892080822389782152905888088",
                "10174440567302396702137861459953192437",
                "333087856393019103838150273657476354460"
            ]
        },
        "id": "CVE-2026-2887-d1c77cf0",
        "signature_type": "Line",
        "source": "https://github.com/aardappel/lobster/commit/8ba49f98ccfc9734ef352146806433a41d9f9aa6",
        "target": {
            "file": "dev/src/lobster/idents.h"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 1956.0,
            "function_hash": "13120769581792069296149603048850509738"
        },
        "id": "CVE-2026-2887-edcec441",
        "signature_type": "Function",
        "source": "https://github.com/aardappel/lobster/commit/8ba49f98ccfc9734ef352146806433a41d9f9aa6",
        "target": {
            "function": "TypeName",
            "file": "dev/src/lobster/idents.h"
        }
    }
]
vanir_signatures_modified 
"2026-07-18T03:58:35Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2887.json"