TI-2026-76173 CVE-2026-112021 · GHSA-6hv3-2r7g-774j
Heap overflow in snac2 JSON parser lets remote attackers crash server
Priority HIGH 77
snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \u0000 escape.