CVE-2026-112021: snac2 before 2.93 Heap-Based Buffer Overflow via JSON Parser _xs_json_load_lexer()
snac2 before 2.93 contains a heap-based buffer overflow vulnerability in xsjsonloadlexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \u0000 escape. Attackers can send a single crafted application/activity+json POST to activitypubposthandler(), which parses it before signature checks, overflowing heap allocations and crashing the server.
Affected Software
Event History
Frequently Asked Questions
Which installations should be treated as affected?
snac2 versions before 2.93 should be treated as affected, particularly where the instance accepts ActivityPub POST requests handled by activitypub_post_handler().
Does an attacker need an account, prior access, or a valid signature?
No. The issue is reachable by an unauthenticated remote attacker, and the JSON is parsed before signature checks occur.
What is the expected impact of a successful attempt?
A crafted request can corrupt heap memory and crash the server, resulting in an availability impact.