{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3asnac2snac2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:snac2:snac2:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-112021"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["snac2 (\u003c 2.93)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["snac2"],"content_html":"\u003cp\u003eThe activitypub server snac2 contains a heap-based buffer overflow vulnerability (CVE-2026-112021) in the _xs_json_load_lexer() function. This vulnerability affects all versions prior to 2.93. The flaw exists because the JSON parser fails to properly handle the \\u0000 (null byte) escape sequence, leading to heap memory corruption. An unauthenticated, remote attacker can exploit this by submitting a crafted application/activity+json payload to the activitypub_post_handler endpoint. Notably, the vulnerability is triggered during the parsing phase, which occurs before the application performs cryptographic signature verification on incoming ActivityPub messages. Successful exploitation typically results in a process crash, leading to a denial-of-service condition for the affected instance.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows unauthenticated attackers to remotely crash snac2 servers. This poses a significant availability risk for organizations and individuals relying on snac2 for federated networking. Because the vulnerability is triggered prior to authentication or signature verification, it is highly accessible to any network-adjacent entity capable of reaching the activitypub_post_handler interface.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade all instances of snac2 to version 2.93 or later to patch CVE-2026-112021.\u003c/li\u003e\n\u003cli\u003eImplement network ingress filtering to limit access to ActivityPub handling endpoints to trusted federated peers, if immediate patching is not possible.\u003c/li\u003e\n\u003cli\u003eMonitor application error logs for repeated segmentation faults or process crashes specifically occurring within the JSON parsing routines of the ActivityPub handler.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-18T12:22:12Z","date_published":"2026-10-18T12:22:12Z","id":"https://feed.craftedsignal.io/briefs/2026-10-snac2-heap-overflow/","summary":"An unauthenticated heap-based buffer overflow in snac2 versions before 2.93 allows remote attackers to trigger memory corruption via a specially crafted JSON payload.","title":"Heap-Based Buffer Overflow in snac2 via Malformed JSON","url":"https://feed.craftedsignal.io/briefs/2026-10-snac2-heap-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:snac2:snac2:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}