Apache Tomcat 11.0.26 Patches HTTP/2 Race Condition That Leaks Request Trailers

·3 views

Apache Tomcat has released version 11.0.26, fixing CVE-2026-77762, a race condition in which a stale HPACK emitter can inject trailer fields from one HTTP/2 request into another recycled request object. The flaw affects Tomcat versions 11.0.0-M1 through 11.0.25, and was privately reported to the Apache security team on 21 August 2026 before being made public on 23 September 2026. Apache rates the vulnerability Low, though a third-party CVSS score of 8.1 has been assigned under CWE-362, creating a notable gap in severity assessments. The practical risk depends on how an application handles trailers — services using them for signatures, routing, or metadata are more exposed, while those that ignore trailers are unlikely to be affected. No configuration-based workaround exists; upgrading to Tomcat 11.0.26, which also addresses four other vulnerabilities in the same release, is the only recommended fix.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Builds AI Pipeline to Turn Voice Notes Into GitHub Pull Requests

A developer set out to simplify task capture on mobile by connecting ChatGPT to the task manager TickTick, allowing spoken ideas to be automatically sorted into planning categories like Backlog or Not Sure. The project expanded when he added a rule: certain trigger phrases like 'you can do it now' would authorize ChatGPT to create a GitHub Issue with enough context for a coding agent to act on. That agent is designed to follow repository instructions, implement the change, and open a Pull Request for human review. He is also building a local runner to pick up agent-ready Issues and execute them using OpenAI Codex, though early tests have surfaced issues with CLI flags, Windows commands, and error recovery. The pipeline is not yet fully functional end to end, but the developer says the process is revealing what a reliable automated development queue actually requires.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Free browser game teaches Linux and Docker commands with no installation required

A developer has launched DockerLinux, a free browser-based game designed to help beginners learn Linux and Docker through hands-on practice. The tool simulates a Linux terminal and Docker environment entirely in JavaScript, requiring no installation, account, or real machine. Players progress through structured missions, earning XP and achievements, with contextual lessons and three-tier hints provided after each command. The simulation supports core Docker features including container lifecycle management, volumes, networks, and docker compose, as well as standard Linux shell operations. Available at dockerlinux.com, the project is open to feedback from both beginners and experienced Docker users to improve accuracy and expand future levels.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds ad-free IP lookup tool using vanilla JS, shares technical lessons

A developer built IPCheck.app, a free single-page IP lookup tool, after growing frustrated with ad-heavy and sign-up-required alternatives. The tool uses vanilla JavaScript with no frameworks, relying on minimal external libraries like Leaflet.js for maps and multiple API endpoints to detect both IPv4 and IPv6 addresses. A key technical challenge was handling dual-stack IP detection, which required two separate ipify endpoints since a single endpoint cannot return both address types simultaneously. The tool also includes a speed test using public Cloudflare endpoints and a password breach checker that uses k-anonymity, meaning the full password hash never leaves the browser. The developer documented these findings in a post on DEV Community, highlighting unexpected complexities such as the imprecision of IP geolocation and the nuances of IPv6 detection.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Warns Free Servers Skew AI Coding Benchmarks, Urges Environment Logging

A developer writing for MonkeyCode's product outreach argues that evaluation scores from free AI servers are unreliable because slow responses and capacity limits can be misread as model reasoning failures. The author distinguishes between a model giving a wrong answer and a shared server returning an incomplete or delayed response, stressing these are different problems that a raw pass rate cannot separate. To address this, they propose treating the free server as a labeled environment variable rather than a neutral baseline, so infrastructure behavior is tracked separately from model quality. The article outlines a four-task evaluation protocol designed to expose issues like truncation, diff formatting, and cold starts, with the classifier and tests runnable offline without an API key. The author deliberately omits live benchmark figures, noting that server allowances change frequently and a blog post is an unreliable place to cache such numbers.

0 comments Read more at DEV Community