CVE-2026-2887
📋 TL;DR
This vulnerability in aardappel lobster allows uncontrolled recursion in the TypeName function, which could lead to denial of service or potentially arbitrary code execution. Only affects users of aardappel lobster up to version 2025.4. The attack requires local access to the system.
💻 Affected Systems
- aardappel lobster
📦 What is this software?
Lobster by Strlen
⚠️ Risk & Real-World Impact
Worst Case
Local attacker could cause denial of service through resource exhaustion or potentially execute arbitrary code with the privileges of the lobster process.
Likely Case
Denial of service through stack overflow or excessive resource consumption, crashing the lobster application.
If Mitigated
Minimal impact if proper access controls limit local user privileges and lobster runs with minimal permissions.
🎯 Exploit Status
Exploit has been publicly disclosed and requires local access. Attack complexity is low once local access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2026.1
Vendor Advisory: https://github.com/aardappel/lobster/releases/tag/v2026.1
Restart Required: Yes
Instructions:
1. Download version 2026.1 from GitHub releases. 2. Replace existing lobster installation with new version. 3. Restart any services using lobster.
🔧 Temporary Workarounds
Restrict local access
allLimit local user access to systems running vulnerable lobster versions
Run with minimal privileges
allEnsure lobster processes run with lowest necessary privileges
🧯 If You Can't Patch
- Implement strict access controls to limit local user access to affected systems
- Monitor for abnormal resource consumption or crashes in lobster processes
🔍 How to Verify
Check if Vulnerable:
Check lobster version: if version is 2025.4 or earlier, system is vulnerable.Check Version:
lobster --versionVerify Fix Applied:
Verify version is 2026.1 or later using version check command.📡 Detection & Monitoring
Log Indicators:
- Repeated crashes of lobster processes
- Stack overflow errors in application logs
- Abnormal memory or CPU consumption by lobster
Network Indicators:
- None - local-only vulnerability
SIEM Query:
Process:lobster AND (EventID:1000 OR EventID:1001) OR Process:lobster AND (MemoryUsage > 90% OR CPUUsage > 90%)🔗 References
- https://github.com/aardappel/lobster/
- https://github.com/aardappel/lobster/commit/8ba49f98ccfc9734ef352146806433a41d9f9aa6
- https://github.com/aardappel/lobster/issues/397
- https://github.com/aardappel/lobster/issues/397#issuecomment-3849015088
- https://github.com/aardappel/lobster/releases/tag/v2026.1
- https://github.com/oneafter/0204/blob/main/lob3/repro.lobster
- https://vuldb.com/?ctiid.347181
- https://vuldb.com/?id.347181
- https://vuldb.com/?submit.755026
