snac2 CVE-2026-112021

No special conditions beyond normal operation - any snac2 instance before version 2.93 that is reachable for federation (the default and intended deployment mode of an ActivityPub server) is exploitable by a remote unauthenticated attacker. The only requirement is that the attacker can reach the ActivityPub inbox endpoint with an application/activity+json POST; crucially, HTTP signature verification does NOT limit exploitation because activitypub_post_handler() invokes the vulnerable _xs_json_load_lexer() parser before the signature check. Limiting factors: the target must be running snac2 < 2.93 with its federation endpoint exposed, and the demonstrated impact is a server crash (denial of service) rather than confirmed code execution or data exposure.

All signals point to a reliable but availability-limited threat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 8.7 HIGH and is credible: the flaw is reachable by any remote, unauthenticated attacker because activitypub_post_handler() parses the attacker-controlled application/activity+json body BEFORE signature verification, so federation authentication provides no protection. However, the vendor's own impact metrics are confined to availability (VC:N/VI:N/VA:H) - this is a heap corruption that crashes the server (denial of service), NOT confirmed remote code execution, so the 8.7 overstates practical consequence relative to an RCE-class 8.7. A public POC exists (exploit gist from the reporter nullenvk, corroborated by VulnCheck), confirming the bug is trivially triggerable, but there is NO EPSS score provided and the CVE is NOT in CISA KEV, so there is no evidence of active in-the-wild exploitation at time of analysis. CWE-122 heap overflow carries theoretical RCE potential that the vendor metrics do not claim; whether this is exploitable beyond a crash is unverified - treat RCE as unconfirmed. Net: a genuine priority for anyone exposing a snac2 instance to federation (patch promptly, DoS is trivial), but tempered by availability-only impact, niche deployment footprint, and no observed active exploitation.

An attacker sends a single crafted application/activity+json POST to a federated snac2 instance's ActivityPub inbox containing a JSON string with a \u0000 escape. Because the body is parsed by _xs_json_load_lexer() before any HTTP signature check, no account or federation trust is needed, and the malformed escape overflows a heap allocation and crashes the server. A public proof-of-concept is available from the reporter, making reliable reproduction straightforward.