CVE-2026-6653: libxml2 Flaw Exposes Hidden SBOM Gaps Beyond Simple Patching

·5 views

A vulnerability tracked as CVE-2026-6653 affects libxml2 versions from 2.9.11 up to but not including 2.11.0, with 2.11.0 named as the fixed release. Because libxml2 is often pulled in indirectly through base images, runtimes, and bundled tools rather than listed as a top-level dependency, a simple package upgrade can miss instances in production. Scoring differs across sources: NVD rates it 9.8 under CVSS 3.1, while the CNA rates it 7.0 under CVSS 4.0, and CISA's SSVC data records no known exploitation. Analysts recommend first building a complete component inventory covering vendor-patched Linux distributions and software that embeds libxml2 silently. A ZoomEye search returned 341 fingerprinted assets, though that count does not reveal installed versions.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Generate PDFs from HTML in n8n Cloud using only a Code node

n8n Cloud does not allow installing PDF libraries in Code nodes, so the author wrote a plain JavaScript generator that builds PDF files directly. The tool can be tested in a browser before being pasted into an n8n Code node, which then returns the PDF as binary data from items containing an HTML field. It handles headings, paragraphs, lists, line breaks, preformatted text, horizontal rules and common HTML entities on A4 pages with automatic page breaks. It does not support CSS, images, tables, links, inline bold or italics, or non-Latin text, so browser-based PDF services remain better for pixel-perfect output. The workflow was tested in n8n Cloud in October 2026, and the code and importable workflow are available free under the MIT license.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

CodeClash Adds a Local-LLM 'Ghost Racer' to Its 1v1 Codeforces Duels

CodeClash is a real-time competitive programming arena where two players, matched by Elo, race to get the first Accepted verdict on the same Codeforces problem. The platform offers ranked matchmaking, private challenge rooms, an embedded multi-language IDE, live verdict tracking, and a global leaderboard. For the Hacktoberfest Open-Source AI Challenge, its developer added a Ghost Racer, an open-weight AI agent that runs locally and competes against a player on the same problem without needing a human opponent. The agent attempts solutions, fails and retries on sample tests, and either wins or drops out. Verdicts are drawn from Codeforces' official submission data rather than a custom judge, and the backend runs on FastAPI with Neon PostgreSQL.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

eMudhra Intermediate CA Keys Found Weak, Enabling Private Key Recovery

eMudhra's April 30, 2025 key-generation ceremony reportedly produced weak private keys for eight intermediate certificate authorities using elliptic-curve cryptography. The affected values were far smaller than the roughly 384 bits of randomness a P-384 key should have, so the private keys could be recovered from the public keys in under a second. A researcher reported the flaw to the Chrome Root Program in October 2026, after the weak intermediates had been publicly trusted for about 18 months. Chrome and Firefox moved quickly to block the affected certificates, and eMudhra revoked the intermediates and announced customer migration support. No public evidence so far shows the weak keys were exploited, though eMudhra's final root-cause analysis is still pending.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Hướng dẫn vòng lặp while và do-while trong Java kèm break và continue

Bài viết tiếp tục đi sâu vào các khái niệm về vòng lặp while trong Java, bao gồm vòng lặp while, do-while và cách dùng các từ khóa break và continue. Vòng lặp while thực thi khối lệnh khi điều kiện còn đúng, và điều kiện được kiểm tra trước mỗi lần lặp. Vòng lặp do-while luôn chạy khối lệnh ít nhất một lần vì điều kiện được đánh giá ở cuối vòng lặp. Từ khóa break được dùng để thoát khỏi vòng lặp hoặc switch ngay lập tức, còn continue bỏ qua lần lặp hiện tại và chuyển sang lần tiếp theo. Bài viết kèm các ví dụ minh họa mã Java cho từng trường hợp.

0 comments Read more at DEV Community