CVE-2026-2641

NameCVE-2026-2641
DescriptionA weakness has been identified in universal-ctags ctags up to 6.2.1. The affected element is the function parseExpression/parseExprList of the file parsers/v.c of the component V Language Parser. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
universal-ctags (PTS)bullseye0+git20200824-1.1vulnerable
bookworm5.9.20210829.0-1vulnerable
trixie5.9.20210829.0-2vulnerable
forky, sid6.2.1-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
universal-ctagssource(unstable)(unfixed)unimportant

Notes

Crash in CLI tool, no security impact
https://github.com/universal-ctags/ctags/issues/4369

Search for package or bug name: Reporting problems