CVE-2026-112021
Received Received - Intake

Heap-based Buffer Overflow in snac2

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: VulnCheck

Description
snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \u0000 escape. Attackers can send a single crafted application/activity+json POST to activitypub_post_handler(), which parses it before signature checks, overflowing heap allocations and crashing the server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-112021
EUVD
EUVD-2026-103474

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
grunfink snac2 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-112021 is a heap-based buffer overflow in snac2 versions before 2.93. The flaw exists in the JSON parser function _xs_json_load_lexer(). An attacker can send a crafted JSON string containing a escape sequence to overflow heap memory. The server processes this input before verifying signatures, leading to heap corruption and crashes.

Detection Guidance

Detect this vulnerability by monitoring for crashes in snac2 servers after receiving JSON payloads. Use network traffic analysis tools like Wireshark to inspect POST requests to activitypub_post_handler() for malformed JSON with escape sequences. Check server logs for heap corruption errors or unexpected terminations.

Impact Analysis

This vulnerability allows unauthenticated remote attackers to crash the snac2 server by sending a single malicious POST request. It can lead to denial of service, potential data corruption, or further exploitation if combined with other flaws. Systems running vulnerable snac2 versions are at risk.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized remote code execution or data exfiltration through heap corruption. Unauthenticated attackers could exploit the buffer overflow to crash servers or manipulate memory, leading to data breaches or service disruptions that violate data protection requirements.

Mitigation Strategies

Immediately upgrade snac2 to version 2.93 or later, as patches address the heap-based buffer overflow in _xs_json_load_lexer(). If upgrading is not possible, restrict network access to the activitypub_post_handler() endpoint or disable it until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112021. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart