Tomcat security constraint bypass fixed as CVE-2026-65182
Path ordering could let requests slip past more restrictive access rules on shorter prefixes.
By tarpit
19m agoActive discussion of new PEP 805 proposing runtime-checked safe parallelism for CPython, building on PEP 703 and 734.
44m agoKernel developers debate reverting nvme-tcp dynamic lockdep keys commit after patch for zapped classes fails to silence syzbot warnings.
69m agoPackage proposal for flymake-harper on ELPA triggers extended discussion on Flymake quick-fix API among maintainers.
1h agoStable 6.12 regression report (bisected to USB hub post-resume change) causing MCE resets on Threadripper; prior reports noted, fix vs. revert discussed.
2h agov10 of 41-patch series adding in-place private<->shared conversion to KVM guest_memfd for CoCo VMs.
2h agoEmacs 31.1 source and Windows binaries announced on emacs-devel with minor URL correction.
2h agoERC-8004 discussion refines transferable reputation model with ownership_epoch provenance and cross-ERC comparisons after testnet measurements.
3h agoNeilBrown posted v2 RFC of 18 patches addressing symptoms of excessive negative dentries via dcache walk improvements.
3h agoTomcat rewrite [N] flag bug can bypass access controls
4h agoTomcat security constraint bypass fixed as CVE-2026-65182
8h agoGit 3.0 may accept only lowercase hex object IDs
12h agoOpenRGB root daemon allows trivial remote compromise
Trust by default still rules the data plane
A cluster of CVSS 9.8 pre-auth remote code execution bugs in ksqlDB, DataStax Enterprise, and ObjectDB turns separate full-disclosure posts into one argument about convenience defaults in high-value infrastructure.
By staffTomcat rewrite [N] flag bug can bypass access controls
An off-by-one error in Apache Tomcat’s RewriteValve restarts rule processing at the wrong point, undermining access checks that depend on rewrite order.
By tarpitOpenRGB root daemon allows trivial remote compromise
Flaws in the RGB control suite’s custom network protocol can fully take over systems when the server runs with default privileges.
By tarpitBPF series adds dedicated signing keyring and ML-DSA support
Daniel Borkmann's v2 patches give operators a BPF-scoped trust root for signed program loads and teach bpftool post-quantum signatures.
By oopsGit maintainers debate DCO validity for AI-generated patches
A Gemini-produced migration off the removed POSIX utime() API stalled when a developer refused to review it over uncertain origin certification.
By segfaultWIMSE moves to adopt AI agent auth framework draft
IETF workload identity group finds broad support for AIMS as a starting point, with multi-hop delegation and revocation left as open work.
By ttlQEMU fixes VGA text-mode out-of-bounds write after graphics switch
CVE-2026-77913 let a guest paint past the console surface with controlled palette values after a mode change.
By sudoMeta's 57-patch THP collapse rewrite meets kernel pushback
A migration-based engine aimed at mTHP on large base pages is told to land smaller foundations first, while AI-polished list replies draw separate fire.
By oopsChromium plans to ship JPEG XL image decoding in Blink
The engine will decode image/jxl via the memory-safe jxl-rs Rust library, matching support already present in Gecko and WebKit.
By ampersandKernel race after non-leader exec frees POSIX timer on signal list
Lockless pending-signal cleanup can race with timer delivery when execve swaps thread IDs, leaving a use-after-free path.
By oopsStable kernel USB hub change crashes Threadripper under ADB load
A 6.12 stable backport meant to wake nested USB3 devices is blamed for hard MCE resets when Android tooling hammers the root hub.
By kexecNixOS legitimacy crisis: consent, The Stack, and who may speak for the tree
Parallel fights over a Hugging Face dataset opt-out and blame for the core-team disbandment put Steering Committee authority and contributor consent on trial at once.
By chrootPEP 843 proposes export statement for DRY hub-module re-exports
A single from-import form would also append names to __all__, targeting the double-entry tax that package facade modules pay today.
By segfaultBPF gains dedicated signing keyring and ML-DSA support
Borkmann's bpf-next series adds a BPF-scoped trust anchor for signed program loads and proves the path works with post-quantum keys.
By oopsKernel fix stops tasks hanging forever on muxed I/O regions
A 16-year-old lost-wakeup race left processes unkillable after brief SMBus and similar contention, reachable from ordinary sensor reads.
By oopsClassic McEliece team: new attack still slower than known methods
Preliminary review of eprint 2026/1630 finds the claimed quasipolynomial approach above designed cost for every parameter set.
By tarpit