SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Critical flaw in LMCache KV cache server allows remote code execution as root

0
·1 views

JFrog disclosed a critical vulnerability (CVE-2026-105192) in LMCache, a caching layer for large language models. The flaw, rated 9.8 out of 10, allows unauthenticated remote code execution via a ZeroMQ socket with no authentication. Versions 0.3.9 through 0.5.5 and development branches are affected, with no fixed version currently available. The vulnerability exists because the server deserializes messages using Python's pickle library before validating them. Official container images run the process as root, granting full system privileges to attackers who can reach the exposed socket.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Healthtech incident recovery requires detailed event reconciliation, not just dashboard status

A healthtech system incident involving a leaked key demonstrates that restoring webhook traffic is insufficient for accurate recovery. A proper postmortem requires reconciling two independent records: the provider's delivery history and the consumer's own receipt and billing ledgers. This reconciliation identifies which events were not acknowledged and should be replayed from a controlled, internal dead-letter queue. The process prevents duplicate billing by ensuring idempotent consumers and precise tracking of replay results.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Independent review finds SupaVoxel outperforms Meshy in 3D model generation

An independent reviewer compared two AI tools, Meshy and SupaVoxel, by converting a drawing of a graduation monkey into a 3D model. The reviewer tested both services using the same PNG image without any text prompts. SupaVoxel produced a significantly smaller and more efficient file, scoring 90/100, while Meshy's model was larger and less optimized, scoring 58/100. The comparison was based on file size, triangle count, and download speed, favoring SupaVoxel for web use. The reviewer emphasized this was a single test, not a comprehensive laboratory study.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

PHP Tutorial Addresses Telegram Bot Rate Limits to Prevent Broadcast Failures

Telegram enforces strict rate limits on bots sending broadcast messages, leading to HTTP 429 errors and failed deliveries if ignored. A naive PHP script that loops through users without pausing will quickly be throttled by the API, causing incomplete broadcasts. To handle this, developers must parse the 'retry_after' parameter in Telegram's error response and pause execution accordingly. This tutorial demonstrates how to build a rate-aware queue system in PHP to ensure reliable message delivery without triggering API restrictions.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Vx build tool introduces fault-tolerant telemetry system for JavaScript monorepos

The vx task runner and build cache for JavaScript monorepos has introduced a new telemetry system. This system is designed to never affect the outcome of a build run, even if a telemetry component fails. Telemetry sinks that throw errors are disabled for the remainder of the run while others continue, and all flushing occurs under a strict timeout. The architecture allows plugins to specify what data they want, avoiding unnecessary overhead for unneeded data streams.

0 comments Read more at DEV Community
Critical flaw in LMCache KV cache server allows remote code execution as root · ShortSingh