A security flaw in the lobster library, specifically the lobster::TypeName routine in idents.h, triggers uncontrolled recursion when manipulated with crafted input. This causes a stack exhaustion cycle, effectively halting the component and leading to a denial‑of‑service condition for processes that invoke the function. The weakness is a classic case of resource exhaustion (CWE‑674) and corrupted resource handling (CWE‑404).

The vulnerability affects versions of the aardappel lobster component up to and including 2025.4. Users deploying the offending code module from the aardappel:lobster product should consider them compromised until they upgrade past the 2025.4 release.

The issue receives a CVSS base score of 4.8, indicating a moderate severity. The EPSS estimate is less than 1 %, suggesting that real‑world exploitation is unlikely, and the bug is not listed in the CISA KEV catalog. Nonetheless, the exploit can only be executed from a local host, meaning an attacker must already have local access; in such a scenario, a successful trigger would abruptly terminate the process, impairing local services. The public disclosure and availability of a patch mitigate the threat, but no widely‑adopted workaround exists yet.