Apache Tomcat Patches HTTP/2 Header Mix-Up Bug Affecting Three Release Branches

·2 views

Apache released Tomcat 11.0.26 on September 15, 2026, addressing CVE-2026-86350, a regression introduced while fixing an earlier HTTP/2 vulnerability, CVE-2026-41293. The flaw affects Tomcat versions 11.0.22–11.0.25, 10.1.55–10.1.59, and 9.0.118–9.0.121, where the HTTP/2 connector can incorrectly attribute request headers to the wrong client on a shared connection. This mismatch can cause cached responses to reach unintended recipients and may cause security rules such as routing or rate limiting to be applied against incorrect request data. Apache has issued fixes across all three branches, with users advised to upgrade to versions 11.0.26, 10.1.60, or 9.0.122 respectively. No active exploitation has been confirmed, but administrators unable to upgrade immediately are encouraged to disable HTTP/2 on the connector as a temporary mitigation.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

What Is RAG? How AI Finds the Right Answer from Your Own Documents

Retrieval-Augmented Generation (RAG) is a technique that allows AI models to answer questions using information retrieved from specific document sources, rather than relying solely on their pre-trained knowledge. The process works in two broad stages: preparing a knowledge base from documents such as PDFs, manuals, or policy files, and then retrieving relevant sections to help the AI generate accurate answers. Documents are broken into smaller chunks so only the most relevant pieces are passed to the model, improving both speed and precision. Embeddings — numerical representations of text — are used to find information based on meaning rather than exact keyword matches. RAG is particularly useful for enterprise applications where an AI needs to reference internal, organisation-specific data that a general model would not otherwise know.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Wazuh custom rules silently fail when file names sort before parent rule files

A subtle but impactful bug in Wazuh 4.14.7 causes custom child rules to silently fail when their containing file is loaded before the file holding the parent rule, due to alphabetical merge ordering. Unlike a typical misconfiguration, the issue produces only warnings — not errors — meaning the config check command wazuh-analysisd -t exits with code 0, giving deploy scripts a false all-clear. Testing on a containerised Wazuh manager confirmed that files named to sort after the parent's file, such as local_rules.xml or any prefix above the parent's file number, load correctly and fire as expected. Administrators can detect affected rules by grepping manager logs or analysisd output for warning codes 7617 and 7619, which identify rules whose parent IDs were not yet loaded. The recommended fix is to place child rules in local_rules.xml or in a file whose name sorts alphabetically after the file containing the parent rule.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Building AI Customer Support Is Easy — Knowing When It Should Answer Is Not

Developers building AI support into FeedLog found that the real challenge is not getting the AI to respond, but determining when it is safe to do so. While AI handles straightforward, well-documented queries effectively, it struggles with complex issues like billing disputes or account failures that fall outside its knowledge base. A hallucination in customer support — such as inventing a feature or giving wrong billing details — can create more problems than it solves, making 'safe resolutions' a more meaningful metric than raw answer volume. The team proposes a hybrid model where AI manages repetitive queries and escalates to humans when conversations grow complex. The key insight from their experience is that a reliable AI support agent must know not just how to answer, but when to stay silent.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why New Google Play Apps Get No Visibility — and How to Fix It

Apps launched on Google Play with zero ratings receive almost no organic search visibility, as the platform's algorithm relies heavily on user engagement signals such as reviews and retention data to rank listings. Without early ratings, an app lacks both algorithmic credibility and social proof, causing potential users to hesitate and further suppressing its conversion rate. Artificially boosting ratings through bot networks or paid review services risks account suspension, as Google's systems can detect inauthentic activity patterns. Developers are advised to use the official In-App Review API and prompt users for feedback only after they have completed a meaningful action within the app. Pre-launch closed testing with real users is also critical to resolving bugs before public release, preventing early one-star reviews that can permanently damage a listing's score.

0 comments Read more at DEV Community