CVE-2026-2887
Uncontrolled Recursion in aardappel lobster lobster::TypeName Function
Publication date: 2026-02-21
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| strlen | lobster | to 2026.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-404 | The product does not release or incorrectly releases a resource before it is made available for re-use. |
| CWE-674 | The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-2887 is a recursion vulnerability in the aardappel lobster software up to version 2025.4, specifically in the function lobster::TypeName within the source file dev/src/lobster/idents.h.
The vulnerability arises from uncontrolled recursion caused by infinite recursive calls among the functions TypeName, FormatArg, and Signature. This leads to excessive consumption of resources such as memory or program stack, resulting in a stack overflow and potential crash of the software.
The attack can only be performed locally, requiring the attacker to have local access to the system. The issue is classified under CWE-674 (Improper Control of Recursive Entity) and CWE-404.
A patch was introduced in version 2026.1 that adds recursion depth tracking to prevent infinite recursion by limiting the depth of recursive calls and substituting overly nested function types with a safe placeholder.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is a stack overflow caused by uncontrolled infinite recursion in the Lobster compiler functions lobster::TypeName, lobster::FormatArg, and lobster::Signature. It can only be exploited locally and requires local access to the system.
Detection involves monitoring for crashes or stack overflow errors when running the Lobster compiler, especially when built in Release mode with AddressSanitizer (ASan) enabled on Linux x86_64 systems.
You can reproduce or detect the issue by building the Lobster compiler with ASan enabled and running it with a specially crafted input file (such as repro.lobster) that triggers the infinite recursion.
Suggested commands include:
- Build Lobster compiler with ASan enabled (example using Clang): clang++ -fsanitize=address -O2 -o lobster src/lobster/*.cpp
- Run the Lobster compiler with a test input file that triggers the recursion (e.g., repro.lobster): ./lobster repro.lobster
- Monitor system logs or ASan output for stack overflow or recursion-related errors.
How can this vulnerability impact me? :
This vulnerability can impact you by causing the Lobster compiler to crash due to a stack overflow triggered by uncontrolled infinite recursion.
Such a crash affects the availability of the software, potentially interrupting development workflows or automated processes that rely on the Lobster compiler.
Since the exploit requires local access, the risk is limited to users or attackers who already have some level of access to the system.
The vulnerability has a low severity score (CVSSv3 base score 3.3) and primarily impacts availability without compromising confidentiality or integrity.
Upgrading to version 2026.1 mitigates this risk by preventing the infinite recursion.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
What immediate steps should I take to mitigate this vulnerability?
The primary and recommended mitigation is to upgrade the Lobster software to version 2026.1, which contains a patch that fixes the uncontrolled recursion issue.
The patch introduces a recursion depth tracking mechanism in the affected functions to prevent infinite recursion and stack overflow.
If upgrading immediately is not possible, avoid running the Lobster compiler on untrusted or specially crafted input files that could trigger the recursion.
Ensure that the Lobster compiler is not run with local untrusted users who might exploit this vulnerability.