Snac2
Monthly
Heap-based buffer overflow in snac2 before 2.93 enables unauthenticated remote attackers to crash the ActivityPub server by sending a single crafted application/activity+json POST whose JSON string contains a \u0000 escape; the vulnerable parser runs before HTTP signature verification, so federation endpoints are exposed. Publicly available exploit code exists, and the assessed impact is availability-only (server crash/denial of service), with no confirmed code execution or data exposure.
Heap-based buffer overflow in snac2 before 2.93 enables unauthenticated remote attackers to crash the ActivityPub server by sending a single crafted application/activity+json POST whose JSON string contains a \u0000 escape; the vulnerable parser runs before HTTP signature verification, so federation endpoints are exposed. Publicly available exploit code exists, and the assessed impact is availability-only (server crash/denial of service), with no confirmed code execution or data exposure.