{"id":"CVE-2026-112021","aliases":["DEBIAN-CVE-2026-112021","EUVD-2026-103474","GHSA-6hv3-2r7g-774j","UBUNTU-CVE-2026-112021"],"status":"published","title":"snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer()...","description":"snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \\u0000 escape. Attackers can send a single crafted application/activity+json POST to activitypub_post_handler(), which parses it before signature checks, overflowing heap allocations and crashing the server.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","from":"ghsa"},"epss":{"day":"2026-11-12","score":0.0067,"percentile":0.52489,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122"],"published":"2026-10-18T11:38:40Z","modified":"2026-10-28T20:15:43Z","fixes":[{"ecosystem":"Debian:14","package":"snac2","fixed_in":["2.93-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:13","package":"snac2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.75-2","2.81-1","2.81-1~bpo13+1","2.81-1~bpo13+2","2.82-1","2.82-1~bpo13+1","2.83-1","2.83-1~bpo13+1","2.84-1","2.84-1~bpo13+1","2.84-2","2.84-2~bpo13+1","2.84-3","2.84-3~bpo13+1","2.85-1","2.85-1~bpo13+1","2.87-1","2.87-1~bpo13+1","2.88-1","2.88-1~bpo13+1","2.89-1","2.89-1~bpo13+1","2.90-1","2.90-1~bpo13+1","2.91-1","2.91-1~bpo13+1","2.92-1","2.92-1~bpo13+1","2.93-1","2.93-1~bpo13+1","2.94-1","2.94-1~bpo13+1","2.95-1","2.95-1~bpo13+1","2.96-1","2.96-1~bpo13+1"]},{"source":"osv","ecosystem":"Debian:14","package":"snac2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.93-1"}]}],"versions":["2.75-2","2.81-1","2.81-1~bpo13+1","2.81-1~bpo13+2","2.82-1","2.82-1~bpo13+1","2.83-1","2.83-1~bpo13+1","2.84-1","2.84-1~bpo13+1","2.84-2","2.84-2~bpo13+1","2.84-3","2.84-3~bpo13+1","2.85-1","2.85-1~bpo13+1","2.87-1","2.87-1~bpo13+1","2.88-1","2.88-1~bpo13+1","2.89-1","2.89-1~bpo13+1","2.90-1","2.90-1~bpo13+1","2.91-1","2.91-1~bpo13+1","2.92-1","2.92-1~bpo13+1","2.93-1~bpo13+1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"snac2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.25-3","2.41-1","2.42-1","2.42-2","2.45-1","2.45-1build2","2.45-1build3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"snac2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.75-2","2.84-1","2.84-2","2.84-3","2.85-1","2.87-1","2.88-1","2.89-1"]}],"products":[{"vendor":"grunfink","product":"snac2"}],"references":[{"url":"https://nullenvk.pl/posts/02-snac2-json"},{"url":"https://gist.github.com/nullenvk/2bf288e2d34cb3d4b7143e61dbf7d90b"},{"url":"https://codeberg.org/grunfink/snac2/src/tag/2.92/xs_json.h#L283-L285"},{"url":"https://codeberg.org/grunfink/snac2/commit/ec2c5c2046e0381bc942ec5d0d05ec861fe377e7"},{"url":"https://codeberg.org/grunfink/snac2/releases/tag/2.93"},{"url":"https://codeberg.org/grunfink/snac2"},{"url":"https://www.vulncheck.com/advisories/snac2-before-2.93-heap-based-buffer-overflow-via-json-parser-xs-json-load-lexer"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112021"},{"url":"https://github.com/advisories/GHSA-6hv3-2r7g-774j"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-112021","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-112021","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-112021","tags":["report"]}],"sources":{"euvd":[{"id":"EUVD-2026-103474","description":"snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \\u0000 escape. Attackers can send a single crafted application/activity+json POST to activitypub_post_handler(), which parses it before signature checks, overflowing heap allocations and crashing the server.","status":"published","published":"2026-10-18T11:38:40Z","modified":"2026-10-19T16:05:15Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:59:51.186399Z"}],"ghsa":[{"id":"GHSA-6hv3-2r7g-774j","title":"snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer()...","description":"snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \\u0000 escape. Attackers can send a single crafted application/activity+json POST to activitypub_post_handler(), which parses it before signature checks, overflowing heap allocations and crashing the server.","status":"published","published":"2026-10-18T12:30:28Z","modified":"2026-10-18T12:30:36Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:13:54.281657Z"}],"osv":[{"id":"DEBIAN-CVE-2026-112021","description":"snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \\u0000 escape. Attackers can send a single crafted application/activity+json POST to activitypub_post_handler(), which parses it before signature checks, overflowing heap allocations and crashing the server.","status":"published","published":"2026-10-18T12:17:15.2Z","modified":"2026-10-23T18:05:33.103626427Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:45:49.824149Z"},{"id":"UBUNTU-CVE-2026-112021","description":"snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \\u0000 escape. Attackers can send a single crafted application/activity+json POST to activitypub_post_handler(), which parses it before signature checks, overflowing heap allocations and crashing the server.","status":"published","published":"2026-10-18T12:17:00Z","modified":"2026-10-28T20:15:43.892287427Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:55:59.591851Z"}]}}