PostgreSQL JDBC driver could silently downgrade SCRAM channel binding, fixed in 42.7.12

·6 views

CVE-2026-54291 affects the PostgreSQL JDBC driver when configured with channelBinding=require. Under that setting, the driver could fall back from SCRAM-SHA-256-PLUS to plain SCRAM-SHA-256 without informing the application. The connection could succeed while the client assumed the stronger protection, which is tied to the TLS tunnel, was in effect. The fix is included in JDBC driver version 42.7.12. Administrators are advised to upgrade all runtimes and bundled drivers and to verify the negotiated authentication mode through integration testing and logging.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Analogy Framing IPv4 Address Scarcity in Terms of Land

A blog post on iptrust.co presents IPv4 address scarcity through a land-ownership analogy. The article is shared on Hacker News, where it gained 6 points and has not yet drawn any comments. The source text provided contains only the title and link metadata, so the specific analogy details and conclusions cannot be verified from this item. The piece appears to explore how the finite supply of IPv4 addresses compares to a scarce, tradable resource such as land.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Batch API Costs Can Double: Six Pitfalls in a .NET OpenAI Batch Pipeline

A developer explains that OpenAI's Batch API offers half-price processing for non-urgent bulk work, but the surrounding application code can erase those savings. The article describes six common mistakes in a .NET 10 batch pipeline, including duplicate batch submissions after a crash. It recommends tagging each batch with metadata and saving state before every provider call so restarts don't resend work. It also advises sorting failures so only transient errors are retried, with a capped attempt budget, and notes that output lines can return out of order and may be missing. The piece is promotional, pointing readers to a paid course for the full working project.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Orquesta Lets Teams Collaborate on Environments via Agent Prompts, Without SSH

Orquesta was built to avoid the risks of sharing SSH keys, which expose entire filesystems and secrets, and which non-technical teammates cannot easily use. Instead, a local agent runs on the machine hosting the environment and executes prompts submitted from a web dashboard. The agent uses the Claude CLI, streams its output live, and commits every change to git, so no shell access is shared with users. Team members receive role-based permissions such as Admin, Developer, Reviewer, and Observer to control who can submit or only view work. The workflow lets a non-engineer request a change that the agent implements on a branch and submits as a pull request for review.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Sub-tenancy should not be an enterprise-only feature for email platforms

The author argues that multi-tenancy in email APIs such as Mailgun's subaccounts, priced at $90 per month on its Scale plan, is bolted on rather than built into the data model. When a platform sends email on behalf of customers, one tenant's bad sending practices, such as importing a dirty list, can damage deliverability for every other customer. The author contends that the customers who most need a tenant boundary are often priced out of it until problems have already occurred. The post notes that the author built Rootmail with tenant boundaries in its schema and is inviting eight free closed-beta testers to report issues. It closes by asking platform operators when sub-tenancy became necessary for them.

0 comments Read more at DEV Community