Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-2887: strlen/lobster recursion can cause local crashes

CVE-2026-2887 · published 8 months ago

Summary

The lobster library used by strlen/lobster (up to version 2025.4) contains a function that can unintentionally call itself repeatedly, leading to a program crash. This can only be triggered by someone with access to the local system, but it could still disrupt operations. Updating to version 2026.1 solves the problem, so apply the update as soon as possible.

What to do

Update strlen lobster to version 2026.1 or later.

Affected software

Vendor	Product	Affected versions
strlen	lobster	< 2026.1 `cpe:2.3:a:strlen:lobster::::::::`

Original advisory text

aardappel lobster idents.h TypeName recursion

A security vulnerability has been detected in aardappel lobster up to 2025.4. This impacts the function lobster::TypeName in the library dev/src/lobster/idents.h. Such manipulation leads to uncontrolled recursion. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. Upgrading to version 2026.1 will fix this issue. The name of the patch is 8ba49f98ccfc9734ef352146806433a41d9f9aa6. It is advisable to upgrade the affected component.

References

https://github.com/aardappel/lobster/ URL
https://vuldb.com/?id.347181 Vendor Advisory
https://vuldb.com/?submit.755026 Vendor Advisory
https://github.com/aardappel/lobster/issues/397 Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2887.j... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-2887 Vendor Advisory
https://github.com/aardappel/lobster/issues/397#issuecomment-3849015088 Third Party Advisory
https://vuldb.com/?ctiid.347181 Third Party Advisory
https://github.com/aardappel/lobster/commit/8ba49f98ccfc9734ef352146806433a41d9f... Patch
https://github.com/aardappel/lobster/releases/tag/v2026.1 Patch
https://github.com/oneafter/0204/blob/main/lob3/repro.lobster Exploit

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.3 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-404Improper Resource Shutdown or Release

CWE-674Uncontrolled Recursion

Timeline

Published21 Feb 2026

Updated29 Oct 2026

First seen6 Mar 2026

Sources

CVE-2026-2887 · NVD

CVE-2026-2887 · OSV

Track software like this

Free during beta