Heap-Based Buffer Overflow in snac2 via Malformed JSON

The activitypub server snac2 contains a heap-based buffer overflow vulnerability (CVE-2026-112021) in the _xs_json_load_lexer() function. This vulnerability affects all versions prior to 2.93. The flaw exists because the JSON parser fails to properly handle the \u0000 (null byte) escape sequence, leading to heap memory corruption. An unauthenticated, remote attacker can exploit this by submitting a crafted application/activity+json payload to the activitypub_post_handler endpoint. Notably, the vulnerability is triggered during the parsing phase, which occurs before the application performs cryptographic signature verification on incoming ActivityPub messages. Successful exploitation typically results in a process crash, leading to a denial-of-service condition for the affected instance.

Impact

The vulnerability allows unauthenticated attackers to remotely crash snac2 servers. This poses a significant availability risk for organizations and individuals relying on snac2 for federated networking. Because the vulnerability is triggered prior to authentication or signature verification, it is highly accessible to any network-adjacent entity capable of reaching the activitypub_post_handler interface.

Recommendation

1. Upgrade all instances of snac2 to version 2.93 or later to patch CVE-2026-112021.
2. Implement network ingress filtering to limit access to ActivityPub handling endpoints to trusted federated peers, if immediate patching is not possible.
3. Monitor application error logs for repeated segmentation faults or process crashes specifically occurring within the JSON parsing routines of the ActivityPub handler.