{"id":"CVE-2026-2887","summary":"aardappel lobster idents.h TypeName recursion","details":"A security vulnerability has been detected in aardappel lobster up to 2025.4. This impacts the function lobster::TypeName in the library dev/src/lobster/idents.h. Such manipulation leads to uncontrolled recursion. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. Upgrading to version 2026.1 will fix this issue. The name of the patch is 8ba49f98ccfc9734ef352146806433a41d9f9aa6. It is advisable to upgrade the affected component.","modified":"2026-08-12T15:33:04.161773Z","published":"2026-02-21T21:02:16.010Z","database_specific":{"cna_assigner":"VulDB","cwe_ids":["CWE-404","CWE-674"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2887.json"},"references":[{"type":"WEB","url":"https://github.com/aardappel/lobster/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2887.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2887"},{"type":"ADVISORY","url":"https://vuldb.com/?id.347181"},{"type":"ADVISORY","url":"https://vuldb.com/?submit.755026"},{"type":"REPORT","url":"https://github.com/aardappel/lobster/issues/397"},{"type":"REPORT","url":"https://github.com/aardappel/lobster/issues/397#issuecomment-3849015088"},{"type":"REPORT","url":"https://vuldb.com/?ctiid.347181"},{"type":"FIX","url":"https://github.com/aardappel/lobster/commit/8ba49f98ccfc9734ef352146806433a41d9f9aa6"},{"type":"FIX","url":"https://github.com/aardappel/lobster/releases/tag/v2026.1"},{"type":"EVIDENCE","url":"https://github.com/oneafter/0204/blob/main/lob3/repro.lobster"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/aardappel/lobster","events":[{"introduced":"0"},{"fixed":"3b836b0cbc78e60e141ace8d542e9a9104ba09d6"},{"fixed":"8ba49f98ccfc9734ef352146806433a41d9f9aa6"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2026.1"}],"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:strlen:lobster:*:*:*:*:*:*:*:*"}}],"versions":["2025.0","2025.1","2025.2","2025.3","2025.4","v2025.4","v2025.3","v2025.2","v2025.1","v2025.0","v2024.0","v2023.13","v2023.12","before_namespace_change","v2023.10","v2023.9","v2023.8","v2023.7","v2023.6","v2023.5","v2023.4","v2023.2","v2021.3","v2021.1","v2021.0","last_wasm_generator_enabled","last_interpreter","last_coroutine","last_frame_log","lastruntimerefc","last_dynamically_typed"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2887.json","vanir_signatures_modified":"2026-08-12T15:33:04Z","vanir_signatures":[{"source":"https://github.com/aardappel/lobster/commit/3b836b0cbc78e60e141ace8d542e9a9104ba09d6","target":{"file":"dev/src/cubegen.cpp"},"deprecated":false,"digest":{"line_hashes":["46575019343674773079592891836700580419","140957871207935101347065596290055151900","307454845477534070013514563560008981795","156206073999728553437417812430121194787","26366910463825801029808292025907054425","44081168939887787255690584213383282136","164060763093415941512973146615891201945"],"threshold":0.9},"id":"CVE-2026-2887-0225601b","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"227256009737831955003652810342855212930","length":695},"id":"CVE-2026-2887-351fbdaa","signature_type":"Function","signature_version":"v1","source":"https://github.com/aardappel/lobster/commit/8ba49f98ccfc9734ef352146806433a41d9f9aa6","target":{"file":"dev/src/lobster/idents.h","function":"Signature"}},{"target":{"file":"dev/src/lobster/idents.h","function":"FormatArg"},"deprecated":false,"digest":{"function_hash":"304735064974996089197437057321316634312","length":207},"id":"CVE-2026-2887-43ffdedc","signature_type":"Function","signature_version":"v1","source":"https://github.com/aardappel/lobster/commit/8ba49f98ccfc9734ef352146806433a41d9f9aa6"},{"id":"CVE-2026-2887-7b45e0a5","signature_type":"Function","signature_version":"v1","source":"https://github.com/aardappel/lobster/commit/3b836b0cbc78e60e141ace8d542e9a9104ba09d6","target":{"file":"dev/src/cubegen.cpp","function":"AddCubeGen"},"deprecated":false,"digest":{"function_hash":"244345584280510524599917864350125512012","length":46679}},{"digest":{"line_hashes":["239285765949067322934000454844632100450","255414495538908661679616648510982195011","42341475388920069817670342920815999538","178862988535679397526097919904432123089","156699660187721883065542877800659225051","261858868297470446191411222917717725831","210771999694009721627437620600580089790","262364797402027718454847673472575549763","252612480201001246305163764941293131905","100802621910838096123150085647102856200","101028120425351004949830447943062934949","236790058042619412715886644912928041805","320235971895888576163121118529691898255","168132076775143415204139068268986705884","273322370637900829667704392279421085075","131123933948446315047232450613911719490","117534529330063369351032184911384081525","220772955914040545923870893234207429178","137181657716500234434816501014549634082","222317656039368419673983645501651662223","140465037631558303983870157552533069719","250322304510398223721354105837728160555","84032017230860419237061467325150760138","237149293700460480486824881170613787880","86558722907637743510303273568253903975","21548386190080236272585248586979758462","202365070927892080822389782152905888088","10174440567302396702137861459953192437","333087856393019103838150273657476354460"],"threshold":0.9},"id":"CVE-2026-2887-d1c77cf0","signature_type":"Line","signature_version":"v1","source":"https://github.com/aardappel/lobster/commit/8ba49f98ccfc9734ef352146806433a41d9f9aa6","target":{"file":"dev/src/lobster/idents.h"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/aardappel/lobster/commit/8ba49f98ccfc9734ef352146806433a41d9f9aa6","target":{"file":"dev/src/lobster/idents.h","function":"TypeName"},"deprecated":false,"digest":{"function_hash":"13120769581792069296149603048850509738","length":1956},"id":"CVE-2026-2887-edcec441"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}]}