Read the docs
TI-2026-02481 Aliases CVE-2026-2887GHSA-v43p-pv9w-gqmf

aardappel lobster idents.h TypeName recursion

Priority MEDIUM 55CWE-404Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-404.

Summary

A security vulnerability has been detected in aardappel lobster up to 2025.4. This impacts the function lobster::TypeName in the library dev/src/lobster/idents.h. Such manipulation leads to uncontrolled recursion. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. Upgrading to version 2026.1 will fix this issue. The name of the patch is 8ba49f98ccfc9734ef352146806433a41d9f9aa6. It is advisable to upgrade the affected component.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00209 11th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD and the CNA
Fix Fixed lobster (aardappel): 2026.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
aardappellobster2025.0; 2025.1; 2025.2; 2025.3; 2025.42026.1Patch availableCNA
  • lobster Vendoraardappel Affected 2025.0; 2025.1; 2025.2; 2025.3; 2025.4 Fixed in 2026.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:strlen:lobster:*:*:*:*:*:*:*:*before 2026.1Vulnerableaardappel
  • cpe:2.3:a:strlen:lobster:*:*:*:*:*:*:*:* Versions before 2026.1 Vulnerable ·aardappel

Remediation

  • Fix · CNA lobster (aardappel) Fixed in 2026.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-2887
  2. 2026-10-03 Alias added: GHSA-v43p-pv9w-gqmf

References

Exploit 3

Patch 2

Other 1

  • TI-2026-01905 aardappel lobster wfc.h WaveFunctionCollapse memory corruption CVSS 4.0MEDIUM 4.8
  • TI-2026-01906 aardappel lobster Parsing parser.h ParseStatements memory corruption CVSS 4.0MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences