Memory-amplification DoS vulnerability patched in py-libp2p WebRTC signaling server

·1 views

A denial-of-service vulnerability was discovered and fixed in py-libp2p, the Python implementation of the libp2p peer-to-peer networking stack used by IPFS, Filecoin, and Ethereum nodes. The flaw resided in a minimal HTTP server handling SDP offer exchanges for WebRTC-Direct transport, where the POST /sdp endpoint read caller-supplied Content-Length values with no upper bound, allowing attackers to force the process to buffer gigabytes of data into memory before any authentication occurred. A malicious 1 GiB request could push resident memory past 2 GB, while four concurrent 300 MiB requests consumed over 1.5 GB, with no mechanism to reject oversized input. The fix, merged on August 14, 2026 via pull request #1396, introduces bounded constants capping accepted body size at 32 KiB and rejecting oversized requests within 0.3 milliseconds. The vulnerability was flagged during a code review of a WebRTC pull request, where a comment about unbounded memory reads was initially easy to dismiss as a style issue rather than an exploitable security flaw.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Proxmox GPU Passthrough Failure Traced to HBA Conflict, Not the GPU

A Proxmox 8 host configured for PCIe passthrough of an NVIDIA RTX A4000 into an Ubuntu 24.04 VM repeatedly failed to start the guest, with QEMU exiting silently and leaving no console output. Host-side dmesg logs revealed IRQ allocation failures and VFIO interrupt remapping errors at VM startup, pointing to a deeper hardware conflict rather than a misconfigured GPU setup. Despite following standard passthrough steps — including VT-d, IOMMU, OVMF BIOS, and q35 machine type — the issue persisted across multiple troubleshooting sessions. The root cause turned out to be a Host Bus Adapter (HBA) in the system, not the GPU itself, making the fault difficult to identify because error messages implicated the wrong device. The passthrough was being set up to accelerate Filecoin sealing workloads, specifically the TreeRC tree-building phase, which can drop from two to three hours down to fifteen to twenty minutes with GPU acceleration.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How PNG Screenshots Become a Defensible PDF Audit Trail for UI Regressions

A structured approach to archiving UI screenshots can prevent costly post-incident disputes when teams cannot trace which build produced a broken state. The method involves compiling PNG snapshots into a single PDF per change window, named with a build identifier, environment tag, and timestamp. Each PDF includes a cover page embedding key metadata such as the git commit SHA, CI job URL, viewport settings, and data seed used during the test run. PNG streams are embedded directly into the PDF without JPEG re-encoding to preserve pixel-exact reproducibility essential for reliable visual diffs. This discipline replaces unstructured screenshot folders with a lightweight, hashable, and ticketable audit log that can answer provenance questions months after a release.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

OpenAI Confirmed Using NVIDIA GB200 NVL72 for AI Training and Inference

NVIDIA has identified OpenAI as one of its Lighthouse model builders deploying the GB200 NVL72 rack-scale system for next-generation model training and production inference. The confirmation came from NVIDIA's Q2 2026 earnings call, which named OpenAI among key users of the integrated data-center-scale platform. Unlike traditional single-GPU setups, the GB200 NVL72 treats a large pool of compute resources as a coordinated system, designed to support both training and serving workloads. Separately, NVIDIA has unveiled its next-generation Vera Rubin platform, with Microsoft Azure announcing plans to integrate Rubin NVL72 racks across its AI superfactories, though no direct OpenAI-Rubin deployment has been confirmed. The developments reflect a broader industry shift from individual accelerators toward tightly integrated, rack-scale infrastructure for frontier AI development.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Fix Flutter Jank: A Systematic Guide to Smoother UI Performance

Flutter is capable of rendering highly smooth interfaces, but common issues such as expensive widget builds, excessive rebuilds, heavy synchronous computations, and inefficient list rendering can cause jank and dropped frames. Developers are advised to always measure performance first using Flutter DevTools in profile mode before making any code changes. CPU-intensive work should be moved out of build methods and, where necessary, offloaded to separate Dart isolates to avoid blocking the UI thread. Rebuilds can be minimized by scoping state changes to only the affected widget subtree, using tools like BLoC's buildWhen, and marking widgets with const constructors where applicable. For large data collections, lazy list builders like ListView.builder are recommended over rendering all items at once, alongside strategies such as image caching and pagination.

0 comments Read more at DEV Community