CVE-2026-112021 in snac2
Summary
by MITRE • 10/18/2026
snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \u0000 escape. Attackers can send a single crafted application/activity+json POST to activitypub_post_handler(), which parses it before signature checks, overflowing heap allocations and crashing the server.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/18/2026
The vulnerability identified in snac2 versions prior to 2.93 represents a critical security flaw rooted in improper input validation within the JSON parsing subsystem. Specifically, the function _xs_json_load_lexer() is susceptible to a heap-based buffer overflow when processing malformed JSON strings that contain the null character escape sequence \u0000. This issue arises because the lexer fails to correctly handle or sanitize this specific control character during the tokenization phase, leading to incorrect memory allocation calculations and subsequent writes beyond the bounds of the allocated heap buffer. The vulnerability is particularly severe due to its location within a component that processes data from external sources before performing essential security checks such as signature verification.
The operational impact of this flaw allows unauthenticated remote attackers to achieve arbitrary code execution or cause a denial of service against the affected server infrastructure. Attackers can exploit this weakness by sending a single, crafted POST request containing application/activity+json content directly to the activitypub_post_handler() endpoint. Because the system parses and processes the JSON payload prior to validating the cryptographic signatures associated with ActivityPub protocols, the malicious data reaches the vulnerable lexer function without being rejected for authentication failures first. This pre-authentication processing window enables an attacker to trigger the heap overflow remotely over the network without requiring any valid credentials or prior interaction with the application.
From a technical classification perspective, this vulnerability aligns with CWE-120, which describes buffer copy without checking size limits, specifically manifesting as a heap-based overflow rather than a stack-based one due to the dynamic memory allocation patterns used by the JSON parser. The exploitation vector corresponds to ATT&CK technique T1190, Exploit Public-Facing Application, as it targets an internet-accessible service component that handles untrusted input. Furthermore, the failure to validate input before processing touches upon CWE-20, Improper Input Validation, and potentially CWE-787, Out-of-bounds Write, depending on how the overflow affects adjacent memory structures or control flow data within the heap metadata.
The severity of this vulnerability is amplified by its potential for remote code execution through heap corruption techniques such as overwriting function pointers or object vtables if the attacker can carefully craft the payload to overwrite specific memory regions following the initial buffer. Even without achieving full code execution, the ability to crash the server process constitutes a significant denial-of-service risk that disrupts availability for legitimate users of the ActivityPub federation network. The fact that this occurs before signature checks means that standard authentication mechanisms are bypassed entirely during the exploitation phase, making detection and prevention more challenging for administrators relying solely on access control lists or API key validation.
To mitigate this vulnerability, organizations running snac2 versions earlier than 2.93 must immediately upgrade to version 2.93 or later where the issue has been resolved by implementing stricter input sanitization within _xs_json_load_lexer(). Until an update can be applied, administrators should consider deploying a Web Application Firewall rule that blocks POST requests containing application/activity+json content with embedded null escape sequences at the network perimeter. Additionally, enabling strict JSON parsing modes that reject non-standard or malformed characters during initial ingestion stages can provide a layer of defense in depth against this specific exploitation path. Regular patch management and continuous monitoring for anomalous memory usage patterns associated with heap corruption attempts are also recommended to maintain system integrity.