Apache Tika PDF Parser Flaw Lets Crafted XFA Blocks Trigger External Entity Resolution

·2 views

A critical vulnerability, tracked as CVE-2025-66516 and rated 10 on CVSS, affects Apache Tika's PDF parser. Crafted XFA content in an uploaded PDF can make the parser resolve an external XML entity, potentially reading local files or making outbound requests from the host. The flaw supersedes an earlier, narrower report, CVE-2025-54988, and affected versions depend on which module parses PDFs, so checking a single dependency is insufficient. A related record, CVE-2026-66755, covers releases below the later fix line in the core and alpha branches. Remediation advice includes upgrading all relevant artefacts, disabling external entity and remote schema resolution for XFA handling, sandboxing extraction without network egress, and stripping XFA payloads where workflows do not need them.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

PS4 Pro DDR3 Read Speed Raised From 10.6 MB/s to 504 MB/s via DMA Patch

A developer working on Linux for the PS4 Pro found that reads from its DDR3 memory were capped near 10.6 MB/s because the CPU fetched data in tiny 8-byte chunks through a narrow PCI window. The chip's southbridge contains a DMA engine that could handle the transfers, but no Linux driver existed for it, and Sony's gameOS driver is closed-source. The developer reverse-engineered the kernel binary to recover the chip's address mapping and the DMA command sequence. A patch was then built that binds the engine as a PCI device and routes transfers through a coherent buffer allocated at startup. Reported results show reads improving to about 504 MB/s and writes to about 425 MB/s, with the engine capable of roughly 1.4 GB/s.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Mozjpeg Gives Smaller White-Background JPEGs With Fewer Off-White Pixels Than Pillow or Sharp

A developer compared Pillow, sharp, and sharp with its mozjpeg option for saving white-background product photos as JPEG. Pillow and default sharp produced identical pixels, while the mozjpeg flag yielded smaller files with fewer stray non-white background pixels at the same quality. None of the encoders kept the background at a pure 255 value across every pixel. The tests were run on three Wikimedia Commons photos using an Apple M4 Mac with Pillow 11.3.0 and sharp 0.34.5. The author found mozjpeg at quality 85 with 4:4:4 sampling roughly matched Pillow at quality 95 in stray-pixel share while using less than half the bytes.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why browser extension UIs break on many sites and how a Shadow DOM wrapper fixes it

Badges injected by browser extension content scripts often render incorrectly on real websites, appearing oversized, misplaced, or missing controls. The problem stems from aggressive global CSS resets, utility classes, and broad element selectors on supermarket web shops that leak into extension widgets. The author, while building the open-source ShrinkWatch EU extension, found a fix by placing the widget inside a Shadow DOM with a reset host element and self-contained styles. The approach also recommends fixed pixel units instead of rem, and attaching the host to the document root so page navigation or body transforms do not disrupt its positioning. The author reports that since version 0.3.2 the badge has looked consistent across the shops tested in a real browser.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Keeping Telegram Inline Keyboard Callbacks Within Limits in PHP

Telegram bots that use inline keyboards for approval or routing workflows often break in production. Telegram enforces a 64-byte limit on callback_data, and oversized payloads can cause keyboards to fail silently or trigger API errors. Another common problem is failing to call answerCallbackQuery promptly, which leaves the client showing a loading spinner until it times out. The article recommends short, compact payload formats instead of embedding full context in buttons. It also proposes a dedicated cURL-based Telegram client that checks HTTP codes and error responses, rather than relying on file_get_contents.

0 comments Read more at DEV Community