The programming mistake behind CVE-2026-119618 is C, but not C.
Had the code used malloc/free(), all would have been fine. But Apache httpd‘s runtime uses its own memory pools. These are not thread safe:
If you allocate memory from two threads you can corrupt the pools. Just via the allocate calls alone.
The pools are kept internally in several data structures and not visible in calls. Modify the „wrong“ hashtable and things explode under load.
Footguns.
As far as I know, CVE-2026-119618, the Apache mod_http2 RCE vulnerability, is not exploitable on a typical installation. It can crash your processes, of course.
@GossiTheDog has further details.
#apache #httpd
The mornings after the #curl anniversary parties are always tricky.
For once, I don‘t remember the room I just woke up in. And I feel sore all over.
There is a very expensive looking, black leather jacket draped over a chair…
Oh, no!😱
GPUs have always been a shady business.
Many thanks to Rafael Sagula and @bagder on having the forsight 30 years ago to start creating the #curl we have today.
There is this video format „what would our world be without…“ where one thing after another blinks out of existence.
So, I start and you add via comments, ok?
Without curl there would be no:
- Netflix
RE: https://infosec.exchange/@ScottHelme/117593615550553878
Rewrite every Python script in Rust. It‘s the only way to make sure.😌
I am losing my will to participate. The idiocy never stops. And when you clear it up, someone presses a button to make more nonsense.
And it only works for them because you care. The smart thing to do would be to stop caring.
So sad.
„And in the face of that, I don’t see a single candidate putting forward a credible and fair vision capable of bringing French people together rather than dividing them. There is no one today offering genuine, sincere hope. It’s always one side against another.“
Teddy Riner has understood. There is no rise of the far right. There is instead a collapse of the center.
I would resist sexy women longer than Jensen and I am willing to prove it!😌
„The economy must be at the service of the people, rather than people being at the service of the economy,“ ~ Pope Leo
Always these religious radicals…💁🏻♂️
https://www.theguardian.com/world/2026/nov/09/pope-leo-argentina-visit-speech-javier-milei-austerity
Dissing C and praising Rust/Go is not about languages.
It‘s people saying: „Terrible people from the past did not provide what we need now. Suckers. Lets burn all this old stuff down!“
Which I totally understand.
Why? Because my generation felt the same about tech stuff in the 80s and 90s. It was all shit and needed to die!
Just stop whining and do it! If you do it right, the next generation will complain about it in 20 years.
Warum heisst es "Rechenzentrum" und nicht einfach "KI-Endlager"?
😌
Opens the report:
"A malicious HTTPS origin can..."
Closes the report.😌
Raging against the machines...😅
You spend hours on getting a fix in with a reliable test case. It's tricky, but you succeed. The world will be a better place.
...then comes ruff in CI and says: "Well you did not import 'A, B, C' but 'A, C, B', nyanyanya"
and you want to just put your fist through its face...😤
Looks like it‘ll be a day of human assessment of clanker security reports.
We‘ve done this several times this year already. Most of them are along the lines of
- someone sets option A and B
- and, at a weird time, switches option C
is #curl still doing the right thing?
Example:
You configure TLS session caching and use of TLS Early Data and subsequently set certificate pinning (not set when the session was cached), is everything checked correctly still?
*looks for a rusty nail*🥵
Quite many #curl versions out there:
Coffee with mother yesterday. She: „What is it with hacking refridgerators?“
Simple greed! Fridge companies sell maintenance.
That used to mean sending out a technician, checking, ordering parts, delivering and installing.
With fridges on the internet, they check online for faults and send parts and the technician in one visit.
Much cheaper!
Unless you count the cost of proper security. Which cuts into/eliminates profits.
Better leave that out and get promoted away before things go wrong.
Congrats to the US people who worked hard to avert the end of the republic.
And to the fossil traders whose greed raised prices so high, it became obvious to people that „this cannot continue“.
