CVE-2026-112021

snac2 before 2.93 contains a heap-based buffer overflow vulnerability in xs json load lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a u0000 escape. Attackers can send a single crafted application/activity+json POST to activitypub post handler(), which parses it before signature checks, overflowing heap allocations and crashing the server.