rabbitmq-c Heap Overflow CVE-2026-44236 Lets On-Path Attackers Crash AMQP Clients

·1 views

A heap-based buffer overflow tracked as CVE-2026-44236 affects rabbitmq-c versions before 0.16.0 and carries a CVSS 3.1 score of 7.1. The flaw arises because clients accept the frame_max value from a server's connection.tune frame without enforcing a minimum, so a malicious value of 1 forces an undersized buffer. An attacker controlling the broker, or positioned on an unencrypted AMQP network path able to rewrite that frame, could trigger memory corruption and likely denial of service. Remote code execution is considered theoretically possible but has not been demonstrated, and confidentiality is not affected. The recommended mitigations are requiring TLS with certificate validation, restricting clients to allowlisted broker addresses, and monitoring for unexpected connection failures, with upgrading to version 0.16.0 as the definitive fix.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Terraform's sensitive marking hid a database change, causing nine minutes of failed writes

A pull request merged in March pointed an order service at a reporting replica, causing every write to fail for nine minutes with a read-only transaction error. The change was hidden in a Terraform plan because a secret in the ECS task definition marked the entire JSON-encoded container definitions as sensitive. Reviewers approved the plan line they usually approve, not realizing the database host change was masked. The team reverted and reapplied, then moved the secret into AWS Secrets Manager so the plan shows full diffs again. They also added a policy check that fails pipelines on fully masked production attributes and a startup check that refuses to report ready if the database is not a primary.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Meeting Transcription Tools in 2025: What Works and What to Look For

AI meeting transcription, which converts spoken words into text using speech recognition and language processing, has matured considerably and now offers real-time transcription and speaker identification. Advances in transformer-based models such as Whisper have improved accuracy even in noisy settings, while hybrid on-device and cloud processing reduces latency and supports privacy. Modern integrations allow transcripts to start automatically and route results to CRMs or project tools. The article stresses that accuracy, measured by word error rate, depends on factors like microphone quality, accent handling, domain vocabulary, and noise robustness. It also notes that open-source options such as Whisper are free but may not suit every team's needs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Idempotency Keys Help Prevent Duplicate Actions in AI Agent Tool Calls

As AI agents increasingly carry out business tasks such as refunds and order creation, retries after timeouts can cause the same action to run twice. The article explains that idempotency keys solve this by marking repeated attempts at one logical operation, so the system recognizes duplicates. It argues that a reliable setup needs stable operation identifiers, request validation, durable execution records, concurrency control, and downstream API support. The author stresses that this protection belongs in the execution architecture rather than in the language model's reasoning. The problem is framed as a distributed-systems issue, since a failed response does not always mean the underlying operation failed.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

CSS Flexbox Explained with Simple Examples

Flexbox is a CSS layout tool for arranging items in a row or column, addressing spacing, centring and navigation-bar problems that web designers long struggled with. Applying display: flex to a parent turns its direct children into flex items that can be aligned, spread, stretched and wrapped using a handful of properties. The article highlights six core properties, namely flex-direction, justify-content, align-items, flex-wrap, gap and flex, which together cover most one-dimensional layouts. Its central concept is the pair of axes: the main axis follows the flow of items, while the cross axis runs perpendicular to it, with justify-content and align-items each controlling one. The piece notes that its guidance draws on MDN's reference material and that confusion typically arises from applying properties to the wrong element or the wrong axis.

0 comments Read more at DEV Community