CVE-2026-112021: Heap-based Buffer Overflow in grunfink snac2

CVE-2026-112021 is a heap-based buffer overflow vulnerability in snac2 prior to version 2.93. The vulnerability exists in the _xs_json_load_lexer() function, which improperly handles JSON strings containing a \u0000 escape sequence. An unauthenticated remote attacker can exploit this by sending a single crafted POST request with application/activity+json content to the activitypub_post_handler() endpoint. This endpoint parses the input before performing signature checks, allowing the attacker to overflow heap allocations, corrupt heap memory, and cause the server to crash. The CVSS 4.0 score is 8.7, indicating high severity with network attack vector, no privileges or user interaction required, and high impact on availability.

Successful exploitation results in heap memory corruption and server crashes, causing denial of service. The vulnerability can be triggered remotely without authentication or user interaction, making it a significant risk for service availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoint and monitor for suspicious POST requests containing JSON with \u0000 escape sequences. Avoid processing untrusted JSON inputs before signature verification.