CVE-2026-2887: 
NixOS vulnerability analysis and mitigation

CVE-2026-2887 is an uncontrolled recursion vulnerability in the aardappel Lobster programming language compiler affecting all versions up to and including 2025.4. The flaw resides in the lobster::TypeName function within dev/src/lobster/idents.h, where mutual recursion between TypeName, FormatArg, and Signature can be triggered by a crafted input file, causing a stack overflow and compiler crash. The vulnerability was reported on February 4, 2026, publicly disclosed on February 21, 2026, and patched in version 2026.1. It carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 1.9 (Low) (GitHub Issue, Red Hat CVE).

The root cause is uncontrolled recursion (CWE-674) combined with improper resource shutdown (CWE-404) in the Lobster compiler's type-name printing logic. When the compiler processes a Lobster source file containing a function type whose argument is itself a function type (a recursive function type structure), the three functions lobster::TypeName, lobster::FormatArg, and lobster::Signature in dev/src/lobster/idents.h (around lines 1466, 1519, and 1570) call each other in an unbounded cycle with no depth limit or base-case guard, exhausting the call stack. The attack vector is local (AV:L) and requires only low privileges — an attacker simply needs to supply a specially crafted .lobster source file to the compiler binary. The fix introduces a depth parameter to TypeName and Signature, truncating recursive function-type expansion when depth exceeds 1 (GitHub Commit, GitHub Issue).

Successful exploitation causes the Lobster compiler process to crash with a stack overflow (SIGSEGV/DEADLYSIGNAL), resulting in a denial-of-service condition for the compilation pipeline. There is no impact on confidentiality or integrity — only availability is affected, and only for the compiler process itself. The scope is limited to local environments where untrusted users can supply source files to the Lobster compiler; there is no network exposure, no data exfiltration risk, and no potential for lateral movement (GitHub Issue, Red Hat CVE).

A proof-of-concept exploit (a crafted repro.lobster file) was publicly disclosed alongside the bug report on GitHub, confirmed to trigger the stack overflow under both ASan-instrumented and standard release builds (GitHub Issue, GitHub Issue Comment). There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.012% (0.000120), reflecting very low probability of exploitation in the wild.

1. Prepare the environment: Obtain a system with the Lobster compiler (version ≤ 2025.4) installed locally, with low-privilege user access.
2. Craft the trigger file: Create a .lobster source file (repro.lobster) that defines a function whose argument type is itself a function type, creating a self-referential or deeply nested function type structure that causes the compiler's type-name printer to recurse indefinitely.
3. Execute the compiler: Run ./bin/lobster repro.lobster from the command line. No special flags are required; the crash occurs during type-checking/error-reporting when the compiler attempts to print the function signature.
4. Observe the crash: The compiler process terminates with a stack overflow (AddressSanitizer: stack-overflow or a segmentation fault in non-instrumented builds), crashing the compilation pipeline (GitHub Issue, GitHub Commit).

• Process: The lobster compiler process terminates abnormally with a segmentation fault or DEADLYSIGNAL (stack overflow); under ASan builds, the error message AddressSanitizer: stack-overflow is printed to stderr.
• Logs: System logs (e.g., /var/log/syslog or dmesg) may record a segfault for the lobster process; core dump files may be generated in the working directory.
• File System: Presence of an unexpected or suspicious .lobster source file in directories accessible to the compiler, particularly one containing deeply nested or self-referential function type annotations (GitHub Issue).

Upgrade the Lobster compiler to version 2026.1 or later, which contains the fix introduced in commit 8ba49f98ccfc9734ef352146806433a41d9f9aa6. The patch adds a depth parameter to TypeName and Signature, substituting a null function type when recursion depth exceeds 1 for V_FUNCTION-typed arguments, breaking the infinite cycle. No configuration-based workaround is available for unpatched versions; the only mitigation is to restrict untrusted users from supplying source files to the compiler until the upgrade is applied (GitHub Commit, Lobster v2026.1 Release).