CVE-2026-2887

Katalog CVE

CVSS 5.5 · Medium EPSS 0,22%

Kerentanan Improper Resource Shutdown or Release pada strlen lobster. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

A security vulnerability has been detected in aardappel lobster up to 2025.4. This impacts the function lobster::TypeName in the library dev/src/lobster/idents.h. Such manipulation leads to uncontrolled recursion. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. Upgrading to version 2026.1 will fix this issue. The name of the patch is 8ba49f98ccfc9734ef352146806433a41d9f9aa6. It is advisable to upgrade the affected component.

Rincian

Terbit di NVD

21 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-404: Improper Resource Shutdown or Release
CWE-674: Uncontrolled Recursion

EPSS (30 hari)

0,22% peluang dieksploitasi; lebih tinggi dari 11,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/aardappel/lobster/issues/397 exploit · issue tracking · advisory vendor
• https://github.com/aardappel/lobster/issues/397#issuecomment-3849015088 exploit · issue tracking · advisory vendor
• https://github.com/aardappel/lobster/commit/8ba49f98ccfc9734ef352146806433a41d9f9aa6 patch
• https://github.com/oneafter/0204/blob/main/lob3/repro.lobster advisory pihak ketiga
• https://vuldb.com/?id.347181 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.755026 advisory pihak ketiga · vdb entry
• https://github.com/aardappel/lobster/ product
• https://github.com/aardappel/lobster/releases/tag/v2026.1 release notes
• https://vuldb.com/?ctiid.347181 permissions required · vdb entry