CVE-2026-2887

Medium CVSS: 4.8

A security vulnerability has been detected in aardappel lobster up to 2025.4. This impacts the function lobster::TypeName in the library dev/src/lobster/idents.h. Such manipulation leads to uncontrolled recursion. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. Upgrading to version 2026.1 will fix this issue. The name of the patch is 8ba49f98ccfc9734ef352146806433a41d9f9aa6. It is advisable to upgrade the affected component.

Vendor

Strlen

Product

Lobster

CWE

CWE-404

Yayın Tarihi

2026-02-21 21:16:11

Güncelleme

2026-02-26 21:41:55

Source Identifier

cna@vuldb.com

KEV Date Added

Kategoriler

CWE-404 Lobster MEDIUM Strlen 2026

Referanslar

https://github.com/aardappel/lobster/ https://github.com/aardappel/lobster/commit/8ba49f98ccfc9734ef352146806433a41d9f9aa6 https://github.com/aardappel/lobster/issues/397 https://github.com/aardappel/lobster/issues/397#issuecomment-3849015088 https://github.com/aardappel/lobster/releases/tag/v2026.1 https://github.com/oneafter/0204/blob/main/lob3/repro.lobster https://vuldb.com/?ctiid.347181 https://vuldb.com/?id.347181 https://vuldb.com/?submit.755026