PT-2026-20354 · Unknown · Universal-Ctags

Oneafter · Published 2026-02-18 · Updated 2026-02-18 · CVE-2026-2641

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions universal-ctags versions up to 6.2.1

Description A flaw exists in the V Language Parser component of universal-ctags. Specifically, the parseExpression/parseExprList functions within the parsers/v.c file are susceptible to uncontrolled recursion. This can be triggered through manipulation and is exploitable on a local host. The exploit code has been publicly released. The project maintainers were notified of the issue but have not yet responded.

Recommendations Versions prior to 6.2.1 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Uncontrolled Recursion

Improper Resource Release

Weakness Enumeration

CWE-674

CWE-404

Related Identifiers

AZL-78087

CVE-2026-2641

Affected Products

Universal-Ctags

References · 18

• 🔥 https://github.com/oneafter/0116/blob/main/poc.v · Exploit
• https://osv.dev/vulnerability/CVE-2026-2641 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-2641 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-2641 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-2641 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-2641 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2641 · Security Note
• https://osv.dev/vulnerability/AZL-78087 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-2641 · Vendor Advisory
• https://github.com/universal-ctags/ctags/issues/4369 · Note
• https://t.me/cveNotify/152288 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2024051537144684547 · Twitter Post
• https://vuldb.com/?ctiid.346397 · Note
• https://vuldb.com/?id.346397 · Note
• https://twitter.com/CVEnew/status/2024011993515196658 · Twitter Post