CVE-2026-112021 is a high severity (CVSS 7.5) heap buffer overflow in snac2 before 2.93. A single crafted ActivityPub JSON post containing a zero character escape can corrupt memory and crash the server before signatures are checked. Upgrade to 2.93 or later.
What's affected
snac2 before 2.93, per the record. The record names the function _xs_json_load_lexer and the activitypub_post_handler as the entry point.
I could confirm the fix version only from the record. The Codeberg release pages I tried needed a browser check, so read the 2.93 release notes yourself. The project page I did fetch shows newer releases, with a version 2.96 commit dated 13 October 2026, so a current build should include the fix.
How to check if you're exposed
Check which version you run. Look at the version your package or build reports, and compare it with 2.93. If you built from source, check the tag you built from.
In logs, look for the server crashing or restarting after incoming POST requests to the inbox. Any instance reachable from the internet receives such requests as a normal part of federation.
What to do now
- Find your snac2 version.
- Upgrade to 2.93 or later, preferably the current release.
- Run the daemon under a supervisor so it restarts after a crash.
- Keep the daemon behind the TLS terminating web server the project recommends.
- Read the release notes for other fixes between your version and the current one.
- Scan your dependencies with the free in-browser scan and look the CVE up in the Gold directory to see where else it appears.
Prioritise by what is reachable, not by the score alone. Reachability analysis asks whether your own code actually calls the vulnerable path and whether an attacker can get to it. A flaw in a component you never expose is less urgent than the same flaw on a public host, so use that view to order your work.
Why it matters
This is CWE-122, a heap based buffer overflow. The JSON parser's handling of the escape for a zero character did not match the way it sized its allocation, so decoded data could overrun the buffer. The record says the parse happens before signature checks, so the sender does not need to be anyone trusted.
Federated servers must accept posts from strangers by design. That makes parsers that run before authentication a prime place for memory safety bugs. The record says the demonstrated result is a crash, a denial of service. It is not listed in CISA KEV.
Quick check
Does signature checking protect me?
No. The record says the JSON is parsed before the signature check.
Which version fixes it?
2.93, per the record. Read the release notes to confirm, and prefer the latest release.
Sources
Last reviewed: 18 October 2026.
