PostgreSQL type confusion flaw CVE-2026-6460 crashes servers via a 22-year-old bug

·8 views

A researcher has published a three-part series on CVE-2026-6460, a type confusion vulnerability in PostgreSQL patched in the November 9 security release. The flaw traces back to May 2004 and affects every PostgreSQL version shipped since ALTER TABLE ... ALTER COLUMN ... TYPE was introduced. Using a low-privilege role and four SQL statements, the researcher showed that the vulnerable 17.11 build crashed with a segmentation fault, while the patched 17.12 returned a descriptor-mismatch error instead. The fix adds composite attribute versioning, which detects when a composite's row type has changed after the datum was created and refuses to produce output. The series also explores how the underlying confusion could be turned into a control-flow hijack.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Which product photos merit an upscaler credit: a test of eight enlargement methods

Free upscaler tiers are metered, so a solo seller must decide which photos justify a credit. The author enlarged three test images, a portrait, a landscape and a self-made text page, down to 512 or 256 pixels and back to 1024, then scored eight methods against the originals. Mostly empty frames such as sky left little for any model to recover, while fine eyelashes and small type separated the methods more clearly. On the text page a GAN-based tier scored lowest on small type despite looking sharpest, and its redrawn strokes make it unsuitable for reading batch codes or prices. Images with hairlines or dense small text should instead be re-exported at the size actually needed.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Laravel 13 Tutorial Covers Validating, Storing and Downloading Uploaded Files

A DEV Community tutorial explains how to handle file uploads in Laravel 13 using a form with multipart encoding, validation rules and the framework's store method. It walks through building a document upload feature that saves the file to a private disk and records its original name, path and size in a database. The guide also shows how to deliver downloads through an authorized route so users can only access their own files. It further advises on choosing between private and public disks and on configuring PHP upload limits in php.ini.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Common Product Mistakes That Lead to App Store Rejection for Under-18 Software

A frequent error in software aimed at under-18s is treating age as an unverified form field, which leaves downstream consent and data handling resting on unreliable information. Teams also often retrofit a parental branch late in development, and the resulting seams signal to reviewers that the consent design was not carefully considered. Safeguarding reporting routes are another weak point: a button without a named responsible person, response time, and record does not function as a real channel. The article further notes that consent records often fail to show which consent model applied to which account and when it changed, and that app store rules from Apple and Google require declared ratings, data disclosures, and screenshots to match the actual product. Products that pass review typically offer age assurance, track consent history, maintain a named safeguarding contact, and present a listing that accurately reflects the app.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Building AJAX CRUD in Laravel 13 with the Fetch API, No Page Reloads

A tutorial shows how to build create, edit and delete actions without reloading the page in Laravel 13. The approach pairs a controller that returns JSON with the browser's Fetch API and a small script that updates the page, avoiding jQuery entirely. The walkthrough covers a task list model and migration, controller methods, and routes that use session and CSRF protection. It also explains how sending an Accept: application/json header makes Laravel return validation errors as 422 JSON responses rather than redirects. The guide targets Laravel 13 with PHP 8.3 to 8.5, Blade and plain JavaScript.

0 comments Read more at DEV Community