---
id: "CVE-2026-112021"
kind: "vulnerability"
aliases: ["CVE-2026-112021"]
title: "snac2 ActivityPub server: heap overflow in JSON parser crashes server"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "snac2", "fixed": ["2.93"], "affected": ">= 0, < 2.93", "ecosystem": "vendor"}]
ecosystems: []
tags: ["activitypub", "heap-overflow", "package", "self-hosted", "snac2"]
not_affected_if: ["not-internet-reachable", "snac2-2.93-or-later", "version-2.93-or-later"]
published_at: "2026-10-18T12:17:15+00:00"
first_seen_at: "2026-10-23T21:57:15+00:00"
updated_at: "2026-10-24T00:22:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112021", "first_seen_at": "2026-10-23T21:57:15+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:22:37+00:00"}]
---

# snac2 ActivityPub server: heap overflow in JSON parser crashes server

snac2 before 2.93 has a heap overflow in its JSON lexer (_xs_json_load_lexer) when a string holds a \u0000 escape. One unauthenticated application/activity+json POST to the inbox handler crashes the server, because the body is parsed before signature checks. A public PoC crashes it and tries tcache poisoning, which suggests a controlled heap write, but no code execution has been shown.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:snac2 affected >= 0, < 2.93 fixed 2.93

## How to check

Run snac --version (or check the package version, e.g. dpkg -l snac2). Any version below 2.93 is affected. If the server is reachable from the internet it is exposed, since the inbox accepts unauthenticated POSTs.

## Fix

Upgrade snac2 to 2.93 or later (fix commit ec2c5c2046e0381bc942ec5d0d05ec861fe377e7). Debian: 2.93-1 in unstable; trixie's 2.75-2 is still vulnerable, so build from upstream. Until you upgrade, a reverse proxy that blocks request bodies containing \u0000 can reduce exposure; this is untested.

## Timeline

- 2026-10-23T21:57:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112021
- 2026-10-24T00:22:37+00:00 analyst — VulnCheck advisory + NVD: CVSS4 8.7 (CNA VulnCheck), v3.1 7.5; fixed in 2.93, commit ec2c5c2 (page unreadable, cookie wall; commit id taken from CVE refs). Public PoC (gist, Jul 2026) crashes server and also attempts tcache poisoning with attacker-controlled next pointer, so heap write primitive exists, but no working RCE shown; CVSS rates availability only. Exploitation in the wild not reported. Debian trixie 2.75-2 vulnerable, sid 2.93-1 fixed. nullenvk writeup unreadable via web-cli. No X posts found.

## Documents

- [advisory] VulnCheck advisory: snac2 before 2.93 heap overflow in JSON parser https://www.vulncheck.com/advisories/snac2-before-2.93-heap-based-buffer-overflow-via-json-parser-xs-json-load-lexer
- [fix] snac2 fix commit ec2c5c2 (listed by CVE record; page not readable, cookie wall) https://codeberg.org/grunfink/snac2/commit/ec2c5c2046e0381bc942ec5d0d05ec861fe377e7
- [poc] snac2 <=2.92 crash PoC (nullenvk) https://gist.github.com/nullenvk/2bf288e2d34cb3d4b7143e61dbf7d90b

## From the sources

snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \u0000 escape. Attackers can send a single crafted application/activity+json POST to activitypub_post_handler(), which parses it before signature checks, overflowing heap allocations and crashing the server.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_