libcurl mTLS flaw allowed wrong client certificate on reused connections

·7 views

A security vulnerability tracked as CVE-2026-8932 has been discovered in libcurl, affecting versions 7.7 through 8.20.0. The flaw stems from an incomplete comparison in libcurl's connection-reuse logic, where five private-key-related fields were excluded from the check that decides whether a pooled TLS connection can be reused. As a result, two handles sharing the same certificate file but using different private keys or passwords could incorrectly reuse the same authenticated connection. A parallel issue in the TLS session cache also allowed sessions tied to different client certificates to collide. The vulnerability was reported by Joshua Rogers of Aisle Research and has been fixed in libcurl 8.21.0, released on June 24, 2026.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developers Can Build Zero-Cost Semantic Search Without LLMs Using FastAPI and Qdrant

A technical guide published on DEV Community outlines how to build a production-grade semantic search engine without relying on large language models or paid AI APIs. The proposed architecture uses FastAPI, Qdrant in-memory vector storage, and Hugging Face's free serverless inference API to generate 384-dimensional text embeddings. Unlike keyword-based search, the semantic approach converts queries into vectors, allowing it to match conceptually similar content even when exact words differ. The entire stack runs on a serverless, Jamstack infrastructure hosted on GitHub Pages, designed to cost nothing at scale and return results in single-digit milliseconds. The guide argues that for the majority of real-world search use cases, direct context-aware document retrieval is more practical and efficient than generative AI responses.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Android App to Edit, Transfer, and Manage Files Without a PC

A developer frustrated by the repetitive cycle of moving files between phone and PC built an Android app called HandyPC to handle the entire workflow on a single device. The app combines a file explorer, text editor with search and replace, SCP/SSH terminal, and basic network diagnostics tools in one place. It supports features like zip file handling, encoding detection, dual-pane view, and wired Ethernet connections via USB-C adapters. The goal was to let users complete the full find-open-edit-send workflow without switching apps or devices. HandyPC is available on the Google Play Store with a free two-month trial followed by a one-time purchase.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

DEV API analysis of 1,634 posts finds no dominant off-site publishing platform among writers

A writer analyzing DEV Community's public API sampled 1,634 recent articles during a roughly four-hour window on September 23, 2026, to identify where authors publish beyond DEV itself. Of those articles, 81.8% declared DEV as their canonical home, while the remaining 18.2% pointed to 149 distinct external hosts. Among those 149 external destinations, 148 were used by exactly one author each, with Medium being the sole exception, hosting just three posts from three different writers. The analysis accounted for platform subdomains using Mozilla's Public Suffix List to avoid inflating destination counts from services like Blogger or GitHub Pages. The core finding is that DEV writers who publish elsewhere do so on their own personal domains, with no single shared platform serving as a meaningful secondary hub.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Go Basics: When to Use 'go run' vs 'go build' in Your Projects

Go is a compiled language, requiring source code to be translated into machine code before execution. The 'go run' command compiles and immediately executes code via a temporary file, making it ideal for quick testing during active development. In contrast, 'go build' produces a permanent standalone binary that can be deployed to servers or shared with users without requiring Go to be installed. Go also supports cross-compilation, allowing developers to build binaries for Windows, Linux, or macOS by setting the GOOS and GOARCH environment variables. Choosing the right command depends on the stage of development — 'go run' for iteration and 'go build' for production-ready deployment.

0 comments Read more at DEV Community