p PatchFirst

CVE-2026-112021

CVE-2026-112021 · snac2 before 2.93 Heap-Based Buffer Overflow via JSON Parser _xs_json_load_lexer()

This page contains facts from public vulnerability sources. Check the original advisory before updating.

snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \u0000 escape. Attackers can send a single crafted application/activity+json POST to activitypub_post_handler(), which parses it before signature checks, overflowing heap allocations and crashing the server.

CVSS 8.7 · High · EPSS 0.7% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • snac2

    Versions
    • ≥ 0, < 2.93: Affected (custom)

    Update to 2.93

  • snac2 Debian:13

    Versions
    • 2.75-2
    • 2.81-1
    • 2.81-1~bpo13+1
    • 2.81-1~bpo13+2
    • 2.82-1
    • 2.82-1~bpo13+1
    • 2.83-1
    • 2.83-1~bpo13+1
    • 2.84-1
    • 2.84-1~bpo13+1
    • 2.84-2
    • 2.84-2~bpo13+1
    • 2.84-3
    • 2.84-3~bpo13+1
    • 2.85-1
    • 2.85-1~bpo13+1
    • 2.87-1
    • 2.87-1~bpo13+1
    • 2.88-1
    • 2.88-1~bpo13+1
    • 2.89-1
    • 2.89-1~bpo13+1
    • 2.90-1
    • 2.90-1~bpo13+1
    • 2.91-1
    • 2.91-1~bpo13+1
    • 2.92-1
    • 2.92-1~bpo13+1
    • 2.93-1
    • 2.93-1~bpo13+1
    • 2.94-1
    • 2.94-1~bpo13+1
    • 2.95-1
    • 2.95-1~bpo13+1
    • 2.96-1
    • 2.96-1~bpo13+1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • snac2 Debian:14

    Versions
    • 2.75-2
    • 2.81-1
    • 2.81-1~bpo13+1
    • 2.81-1~bpo13+2
    • 2.82-1
    • 2.82-1~bpo13+1
    • 2.83-1
    • 2.83-1~bpo13+1
    • 2.84-1
    • 2.84-1~bpo13+1
    • 2.84-2
    • 2.84-2~bpo13+1
    • 2.84-3
    • 2.84-3~bpo13+1
    • 2.85-1
    • 2.85-1~bpo13+1
    • 2.87-1
    • 2.87-1~bpo13+1
    • 2.88-1
    • 2.88-1~bpo13+1
    • 2.89-1
    • 2.89-1~bpo13+1
    • 2.90-1
    • 2.90-1~bpo13+1
    • 2.91-1
    • 2.91-1~bpo13+1
    • 2.92-1
    • 2.92-1~bpo13+1
    • 2.93-1~bpo13+1
    Affected ranges
    • ECOSYSTEM: < 2.93-1

    Update to 2.93-1

  • snac2 Ubuntu:24.04:LTS

    Versions
    • 2.25-3
    • 2.41-1
    • 2.42-1
    • 2.42-2
    • 2.45-1
    • 2.45-1build2
    • 2.45-1build3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • snac2 Ubuntu:26.04:LTS

    Versions
    • 2.75-2
    • 2.84-1
    • 2.84-2
    • 2.84-3
    • 2.85-1
    • 2.87-1
    • 2.88-1
    • 2.89-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →