CVE-2026-2641: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-2641 is an uncontrolled recursion vulnerability in the V Language Parser of universal-ctags (ctags) affecting versions up to and including 6.2.1. The flaw resides in the parseExpression/parseExprList functions within parsers/v.c, where mutual recursion between these two functions lacks any depth limit, enabling a stack overflow via a specially crafted V source file. The vulnerability was reported to the project on January 16, 2026, via GitHub issue #4369, and publicly disclosed on February 18, 2026; the upstream project had not responded with a fix at the time of disclosure. It carries a CVSS v3.1 base score of 3.3 (Low) (Red Hat CVE, Red Hat Bugzilla).

The root cause is uncontrolled recursion (CWE-674) combined with improper resource shutdown (CWE-404) in the V language parser. The parseExpression function at parsers/v.c:2721 calls parseExprList, which in turn calls parseExpression again at line 2744, forming a mutually recursive cycle with no recursion depth guard. A locally accessible attacker with low privileges can craft a V source file containing deeply nested expressions (e.g., deeply nested parentheses or array literals) and pass it to ctags, triggering stack exhaustion and a crash. A public proof-of-concept (poc.v) is available in the GitHub repository oneafter/0116, and the ASAN stack trace confirming the infinite recursion loop was included in the upstream bug report (GitHub Issue, PoC File).

Successful exploitation results in a denial-of-service condition through stack exhaustion, causing the ctags process to crash. There is no impact on confidentiality or integrity — only availability is affected, and only to a low degree given the local-only attack vector. The scope is limited to the ctags process itself; no lateral movement or data exposure is possible through this vulnerability (Red Hat CVE, Red Hat Bugzilla).

A public proof-of-concept (poc.v) has been published in the oneafter/0116 GitHub repository, lowering the barrier to exploitation. Exploitation requires local access and low privileges, with no user interaction needed. There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is 0.013% (0.000130), indicating a very low probability of exploitation in the near term. This CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat CVE, PoC File).

1. Prepare the environment: Obtain a system with universal-ctags version ≤ 6.2.1 installed and local user-level access.
2. Obtain or craft the PoC file: Download the publicly available poc.v from https://github.com/oneafter/0116/blob/main/poc.v, or manually create a V language source file containing deeply nested expressions (e.g., deeply nested parentheses or array literals) sufficient to exhaust the default stack size.
3. Execute ctags against the malicious file: Run the following command as a low-privileged local user:

   ctags -f /dev/null --sort=no poc.v

4. Trigger uncontrolled recursion: The V language parser's parseExpression function (v.c:2721) calls parseExprList, which calls parseExpression again (v.c:2744), cycling indefinitely until the process stack is exhausted.
5. Observe crash: The ctags process terminates with a stack-overflow signal (SIGSEGV or SIGABRT under ASan), resulting in denial of service for any tooling or editor integration dependent on ctags (GitHub Issue, PoC File).

• Process: The ctags process terminates abnormally (exit code non-zero, signal SIGSEGV or SIGABRT) when processing a .v file; unusually deep call stacks visible in crash dumps alternating between parseExpression and parseExprList in parsers/v.c.
• Logs: System logs (e.g., /var/log/syslog, journalctl) may record segmentation fault or abort signals from the ctags process; ASan-enabled builds will emit AddressSanitizer: stack-overflow messages to stderr.
• File System: Presence of a crafted .v file with deeply nested expressions (e.g., hundreds of levels of nested parentheses or array literals) in directories processed by ctags; core dump files (core.*) generated by the ctags process in the working directory (GitHub Issue).

No official patch from the universal-ctags project was available at the time of disclosure, as the project had not responded to the bug report. As interim mitigations: restrict local access to ctags to only necessary users; avoid running ctags against untrusted V language source files; consider disabling V language parsing if not required (e.g., via ctags configuration options). Monitor the upstream repository (https://github.com/universal-ctags/ctags) for a fix and upgrade to a version newer than 6.2.1 once released. Red Hat has tracked this issue and recommends following upstream for patch availability (Red Hat CVE, Red Hat Bugzilla).

Red Hat's Product Security team tracked the issue via Bugzilla (Bug 2440536) and assigned it a low severity/priority rating. The Tenable Nessus plugin 299393 was created to detect affected installations. No significant public commentary from notable security researchers or broad media coverage has been identified beyond standard vulnerability database aggregation (Red Hat Bugzilla, Tenable).