Key points
- CVE-2026-112021 affects grunfink snac2 versions prior to 2.93.
- The vulnerability is a heap-based buffer overflow rated CVSS 8.7 HIGH.
- Attackers can exploit the flaw via a single crafted POST request.
Unauthenticated remote attackers can exploit a heap-based buffer overflow in snac2 before version 2.93 to corrupt memory and crash servers. The vulnerability, tracked as CVE-2026-112021, allows exploitation through a single malicious application/activity+json POST request to the activitypub_post_handler() function.
What happened
The National Vulnerability Database records CVE-2026-112021 as a high-severity issue with a CVSS score of 8.7. The flaw resides in the _xs_json_load_lexer() function within grunfink snac2 software versions earlier than 2.93. It is classified under CWE-122, indicating a heap-based buffer overflow.
An attacker can trigger the vulnerability by sending a JSON string containing a \u0000 escape sequence. This payload is processed by the activitypub_post_handler() function before any signature verification takes place. The premature parsing causes heap allocations to overflow, resulting in memory corruption and server crashes.
Why it matters
The ability to crash a server with a single unauthenticated request poses a significant availability risk. Because the parsing occurs before signature checks, attackers do not need valid credentials to exploit the flaw. This allows exploitation without prior authentication.
Organisations running exposed versions of snac2 face immediate service disruption threats. The lack of a confirmed patch means systems remain vulnerable to denial-of-service attacks. Security teams must assess their exposure to public-facing ActivityPub endpoints to determine risk levels.
What happens next
- Identify all instances of snac2 running versions before 2.93.
- Monitor for vendor announcements regarding a security update.
- Review server logs for unusual JSON POST requests.
- Prepare incident response plans for potential service outages.
Patch priority
Teams usually prioritise systems exposed to untrusted internet traffic. Check whether public-facing ActivityPub endpoints are running vulnerable software. Isolate critical services from direct internet access where possible. Back up configurations before applying any changes. Monitor network traffic for signs of exploitation attempts. Reduce exposure by restricting access to known trusted sources.
What to do and how to stay safe: snac2
- Audit all snac2 installations to confirm version numbers.
- Restrict access to ActivityPub endpoints using firewalls.
- Monitor server logs for unexpected JSON POST requests.
- Prepare to isolate affected servers if crashes occur.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-112021?
The CVSS score is 8.7, which is rated as HIGH severity.
Which function is vulnerable in snac2?
The _xs_json_load_lexer() function contains the heap-based buffer overflow.
Is there a patch available for this vulnerability?
No fix has been confirmed yet for affected versions.
