CVE-2026-112021 Details
Description
snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \u0000 escape. Attackers can send a single crafted application/activity+json POST to activitypub_post_handler(), which parses it before signature checks, overflowing heap allocations and crashing the server.
A heap-based buffer overflow vulnerability has been identified in snac2 versions prior to 2.93. The issue arises in the JSON parsing function '_xs_json_load_lexer()', where the parser fails to properly handle null byte escapes in JSON strings. This vulnerability allows unauthenticated remote attackers to send crafted 'application/activity+json' POST requests that corrupt heap memory, leading to a server crash. The vulnerability can be exploited by sending a JSON string containing a '\u0000' escape, which the parser incorrectly processes, causing a heap overflow that crashes the server.
Users can update to snac2 version 2.93 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 18, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| snac2 | >= 0, < 2.93 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 18, 2026 | New CVE Received | [email protected] |