{"id":"CVE-2026-112021","kind":"vulnerability","aliases":["CVE-2026-112021"],"related":[],"title":"snac2 ActivityPub server: heap overflow in JSON parser crashes server","description":"snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \\u0000 escape. Attackers can send a single crafted application/activity+json POST to activitypub_post_handler(), which parses it before signature checks, overflowing heap allocations and crashing the server.","summary":"snac2 before 2.93 has a heap overflow in its JSON lexer (_xs_json_load_lexer) when a string holds a \\u0000 escape. One unauthenticated application/activity+json POST to the inbox handler crashes the server, because the body is parsed before signature checks. A public PoC crashes it and tries tcache poisoning, which suggests a controlled heap write, but no code execution has been shown.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"snac2","fixed":["2.93"],"affected":">= 0, < 2.93","ecosystem":"vendor"}],"ecosystems":[],"tags":["activitypub","heap-overflow","package","self-hosted","snac2"],"not_affected_if":["not-internet-reachable","snac2-2.93-or-later","version-2.93-or-later"],"how_to_check":"Run snac --version (or check the package version, e.g. dpkg -l snac2). Any version below 2.93 is affected. If the server is reachable from the internet it is exposed, since the inbox accepts unauthenticated POSTs.","fix":"Upgrade snac2 to 2.93 or later (fix commit ec2c5c2046e0381bc942ec5d0d05ec861fe377e7). Debian: 2.93-1 in unstable; trixie's 2.75-2 is still vulnerable, so build from upstream. Until you upgrade, a reverse proxy that blocks request bodies containing \\u0000 can reduce exposure; this is untested.","status":"open","published_at":"2026-10-18T12:17:15+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-23T22:37:31+00:00","updated_at":"2026-10-24T00:22:37+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:37:31Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade snac2 to version 2.93 or later.","reach":"internet","title":"snac2 ActivityPub server: heap overflow in JSON parser crashes server","impact":"high","summary":"snac2 is a small ActivityPub server, and before version 2.93 its JSON lexer overflows a heap buffer when a JSON string contains a \\u0000 escape. An unauthenticated remote attacker can send one crafted POST to the inbox handler, which parses the body before signature checks, to corrupt heap memory and crash the server.","category":"package","who_cares":["snac2","activitypub","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Server crashes; heap corruption may allow further memory abuse","analyst_note":"Confirm whether heap corruption yields code execution, not just a crash, and find the exact fixed commit; check the NVD entry for the CVSS vector and the upstream snac2 release notes.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["version-2.93-or-later"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000498,"input_tokens":2958,"output_tokens":404,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether heap corruption yields code execution, not just a crash, and find the exact fixed commit; check the NVD entry for the CVSS vector and the upstream snac2 release notes.","search":"'-112021':13A,16A '-2026':12A,15A '2.93':29B,93C 'activitypub':2A,18B,134C 'alloc':145C 'allow':108C 'application/activity':51B,130C 'attack':111C,124C 'base':98C 'bodi':63B 'buffer':99C 'check':68B,142C 'code':86B 'contain':94C,120C 'control':81B 'corrupt':113C 'craft':129C 'crash':9A,58B,72B,147C 'cve':11A,14A 'escap':48B,123C 'execut':87B 'handler':57B,136C 'heap':4A,20B,32B,82B,97C,114C,144C 'heap-bas':96C 'heap-overflow':19B 'hold':45B 'host':25B 'inbox':56B 'json':7A,36B,39B,52B,104C,118C,131C 'lexer':37B,41B,106C 'load':40B,105C 'memori':115C 'one':49B 'overflow':5A,21B,33B,100C,143C 'packag':22B 'pars':65B,138C 'parser':8A 'poc':71B 'poison':77B 'post':53B,132C,135C 'public':70B 'remot':110C 'self':24B 'self-host':23B 'send':117C,126C 'server':3A,10A,60B,149C 'shown':90B 'signatur':67B,141C 'singl':128C 'snac2':1A,17A,26B,27B,91C 'string':44B,119C 'suggest':79B 'tcach':76B 'tri':75B 'u0000':47B,122C 'unauthent':50B,109C 'vulner':101C 'write':83B 'xs':38B,103C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T12:17:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-112021","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112021","severity":null,"published_at":"2026-10-18T12:17:15+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112021:648","url":null,"severity":null,"published_at":"2026-10-24T00:22:37+00:00","modified_at":"2026-10-24T00:22:37+00:00","first_seen_at":"2026-10-24T00:22:37+00:00","fetched_at":"2026-10-24T00:22:37+00:00","note":"VulnCheck advisory + NVD: CVSS4 8.7 (CNA VulnCheck), v3.1 7.5; fixed in 2.93, commit ec2c5c2 (page unreadable, cookie wall; commit id taken from CVE refs). Public PoC (gist, Jul 2026) crashes server and also attempts tcache poisoning with attacker-controlled next pointer, so heap write primitive exists, but no working RCE shown; CVSS rates availability only. Exploitation in the wild not reported. Debian trixie 2.75-2 vulnerable, sid 2.93-1 fixed. nullenvk writeup unreadable via web-cli. No X posts found."}],"documents":[{"id":2573,"url":"https://www.vulncheck.com/advisories/snac2-before-2.93-heap-based-buffer-overflow-via-json-parser-xs-json-load-lexer","title":"VulnCheck advisory: snac2 before 2.93 heap overflow in JSON parser","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2574,"url":"https://gist.github.com/nullenvk/2bf288e2d34cb3d4b7143e61dbf7d90b","title":"snac2 <=2.92 crash PoC (nullenvk)","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":2575,"url":"https://codeberg.org/grunfink/snac2/commit/ec2c5c2046e0381bc942ec5d0d05ec861fe377e7","title":"snac2 fix commit ec2c5c2 (listed by CVE record; page not readable, cookie wall)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}