Live › vulnerability › CVE-2026-112021
Go to dashboardsnac2 before 2.93 has a heap overflow in its JSON lexer (_xs_json_load_lexer) when a string holds a \u0000 escape. One unauthenticated application/activity+json POST to the inbox handler crashes the server, because the body is parsed before signature checks. A public PoC crashes it and tries tcache poisoning, which suggests a controlled heap write, but no code execution has been shown.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| snac2 | vendor | >= 0, < 2.93 | 2.93 |
dpkg -l snac2)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \u0000 escape. Attackers can send a single crafted application/activity+json POST to activitypub_post_handler(), which parses it before signature checks, overflowing heap allocations and crashing the server.
This page as .md · .json · in your agent: get_signal("CVE-2026-112021")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.