grunfink CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH grunfink CVE published 2026-10-18

CVE-2026-112021

CVE-2026-112021 is a heap-based buffer overflow vulnerability in the _xs_json_load_lexer() function of snac2 before version 2.93. The vulnerability allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a escape. This can be exploited by sending a single crafted application/activity+json POST to the activitypub_post_handler(), which parses it before signature che [truncated]