segfault
Languages & Toolchains desk
Go patches HTTP/2 CPU spike from SETTINGS window updates
CVE-2026-78669 let a malicious peer burn CPU with many streams and repeated initial window size changes.
Go x/net 0.60.0 patches HTTP/2 memory and CPU exhaustion flaws
Three server-side bugs let malicious HTTP/2 peers exhaust memory, burn CPU, or bypass flow-control limits.
Go x/net 0.60.0 patches HTTP/2 memory and CPU flaws
Three server and client issues, including trailer-driven memory exhaustion tracked as CVE-2026-78659, are fixed in the supplementary net package.
Git eyes 2.7x faster SHA-1 collision checks via C port
Scott Chacon ports Sam Reis’s vectorized sha1dc approach from Rust so every Git build keeps safe hashing without the usual slowdown.
Go HTTP/2 client fixed for Content-Length smuggling risk
CVE-2026-78660 covers a transport that forwarded conflicting length headers through reverse proxies to HTTP/1 clients.
LLVM RFC seeks ban on AI text in PRs and proposals
A developer wants to keep AI for code but bar generated prose that is flooding reviewers with verbose, low-value descriptions.
LLVM backends still break freeze, inviting miscompiles
An RFC seeks proper machine-IR support for freeze so poison and undef stop producing inconsistent values after instruction selection.
Free-threaded Python forces the concurrency contract into the open
PEP 805's object-state checks and a push to write down distinct memory models mark the shift from GIL-hidden races to explicit programmer assumptions.
PEP 824 proposes None-coalescing operators for Python
The ?? and ??= forms would supply defaults only when a value is None, and can be accepted independently of related None-aware access syntax.
Glibc ld.so overflow hits setuid programs via $ORIGIN paths
CVE-2026-95818 lets a local user crash or partially corrupt AT_SECURE binaries on glibc 2.14 through 2.44.
PEP 823 proposes None-aware ?. and ?[] operators for Python
The draft splits long-running PEP 505 ideas so access operators can be judged apart from coalescing ones.
glibc ld.so TOCTOU lets local users hijack $ORIGIN on setuid binaries
CVE-2026-86805 covers a race in $ORIGIN path handling that can load attacker code into AT_SECURE programs when hardlink protection is off.
glibc DNS resolver aborts on long search domains
CVE-2026-8674 can crash name-resolving processes when a search list entry is roughly 200 characters or longer, including via DHCP or VPN-supplied resolv.conf data.
Python elects its first Packaging Council
Five long-time packaging maintainers form a formal governing body after a tightly contested community vote.
glibc fixes resolver abort on long search domains
CVE-2026-8674 let an oversized resolv.conf or LOCALDOMAIN entry kill any process that used the stub resolver.
glibc SHIFT_JISX0213 iconv hang fixed as CVE-2026-77117
Crafted SHIFT_JISX0213 input could stall iconv conversions from glibc 2.3 through 2.44 when the output buffer split a two-code-point decode.
glibc tdelete stack overflow fixed as CVE-2026-19542
A rare out-of-bounds stack write in the binary tree API could crash apps that build million-node trees.
Glibc flags buffer overflow in strfmon monetary formatting
CVE-2026-19499 covers a padding overflow in GNU C Library 2.38 through 2.44, fixed in 2.45.
SwiftPM proposes unifying package products and targets
An early design would collapse the two concepts into targets controlled by visibility rules, seeking to reduce manifest confusion while keeping migration paths open.
Julia forum debates auto-deleting LLM-written posts
A package announcement dismissed as AI slop triggered calls for detection tools and a split over quality rules versus origin bans.
CPython weighs race-free objects, export rules, and a one-shot ABI break for free threading
PEPs on object states, public and private builtins, export syntax, and a stable-ABI reset show the project trading compatibility surface for parallel performance while Guido still shapes the arguments.
Go x509 URI constraints wrongly allow subdomain matches
CVE-2026-78665 covers a rare name-constraint mishandling in crypto/x509 that treated URI rules like DNS names.
RFC would enable ClangIR by default, at steep build cost
ClangIR maintainers want MLIR as a normal Clang dependency and CIR tests in default CI, while leaving codegen off unless users opt in with -fclangir.
Go x509 email constraints mishandle subdomains, CVE-2026-78664
RFC 5280 rfc822Name rules differ from DNS matching; Go applied the wrong model and is treating the bug as a public security issue.
Git fixes pathspec overflow with exclude patterns
Negative pathspecs shorter than a shared positive prefix could trigger a heap buffer over-read, and excludes at the front blocked prefix optimization.
glibc patches heap overflow in fopen ccs= charset handling
CVE-2026-18374 let a crafted empty charset name overrun a heap buffer when opening files with character conversion.
glibc fixes heap overflow in fopen ccs= charset handling
Empty character-set names in mode strings could overrun a heap buffer, tracked as CVE-2026-18374.
Python pushed to document concurrency and memory models
Mark Shannon argues CPython still lacks written guarantees on atomicity and threading for GIL and free-threaded builds as the global lock is phased out.
glibc closes LANGUAGE path traversal in gettext loading
CVE-2026-84243 completes a 2014 locale fix so attackers who can set LANGUAGE cannot steer message catalogs to arbitrary .mo files.
glibc plugs heap overflow in fopen ccs= charset handling
CVE-2026-18374 let a crafted mode string overrun a small heap buffer when a charset token stripped to empty.
glibc plugs SHIFT_JISX0213 iconv hang (CVE-2026-77117)
The converter left pending combining-character state uncleared, so resumed iconv calls could stall instead of making progress.
Swift pitch proposes @called(once) for one-shot function values
The attribute would let the compiler enforce at-most-once calls and reason about closure captures alongside non-copyable types.
Git 3.0 may accept only lowercase hex object IDs
An RFC series would stop parsing uppercase so Git matches what it emits and what most tooling already assumes.
Git maintainers debate DCO validity for AI-generated patches
A Gemini-produced migration off the removed POSIX utime() API stalled when a developer refused to review it over uncertain origin certification.
PEP 843 proposes export statement for DRY hub-module re-exports
A single from-import form would also append names to __all__, targeting the double-entry tax that package facade modules pay today.
Go sumdb fixes reopen who anchors module trust
Two sumdb bypasses fixed across the Go toolchain show that a hostile GOPROXY and GOSUMDB pair could still feed undetected modules into the local cache, pressing the question of where module trust actually sits.
Julia core sees agent-written PRs surge, community frets
After JuliaCon figures put AI authorship near four-fifths of recent language PRs, developers split on access, review norms, and whether the language still recruits humans.
PEP 825 wheel variants format gains ground after major rewrite
Revised package metadata for selectable wheel builds is merged and draws a solid first review, while dependency-on-variant stays out of scope.
Go patches sumdb bypasses in golang.org/x/mod 0.40.0
Two CVEs let a hostile GOPROXY and GOSUMDB serve malicious modules that the transparency log would not catch.
Go x/mod 0.40.0 fixes sumdb bypasses for malicious modules
Two flaws let a hostile module proxy or checksum database slip attacker-controlled code past transparency-log checks into the local cache.
Go 1.26.6 and 1.25.13 fix sumdb bypass and module cache attacks
Point releases close flaws that let malicious proxies and checksum databases slip unverified modules past GOSUMDB checks.
Go 1.27 RC3 plugs module proxy checksum bypasses
The candidate ships ten security fixes, led by flaws that let a hostile GOPROXY or GOSUMDB slip malicious modules past transparency checks.
Go 1.26.6 and 1.25.13 close module sumdb bypasses
The point releases ship ten security fixes, including flaws that let a malicious proxy or sumdb serve undetected attacker-controlled modules.
Git fixes quadratic pack loading slowdown in large monorepos
A late-2025 packfile store refactor made everyday commands crawl when tens of thousands of packs were present.
Git refuses non-HTTP bundle URIs after Windows NTLM leak
Advertised file and UNC bundle paths could force outbound SMB and expose credentials on Windows clones.
glibc fixes wordexp use-after-free on WRDE_APPEND errors
CVE-2026-6368 closed a dangling-pointer bug that could free the wrong buffer after a failed append expansion.
LLVM eyes official status for DirectX backend
An RFC seeks to graduate the DXIL code generator from experimental, with maintainers saying debug-info evolution would stay unhindered.
CPython developer proposes one-time stable ABI break
Mark Shannon wants freedom to reshape object headers for cleaner code and speed, while extension maintainers flag costs for abi3 wheels.
Git for Windows 2.55.0(4) fixes NTLM hash leak via bundle URIs
CVE-2026-62960 let hostile Git servers push Windows clients into disclosing NTLMv2 hashes over the network.
Go 1.26.6 and 1.25.13 security releases due August 11
The Go team will ship private standard library and toolchain fixes for three CVEs.
glibc 2.41 backport treats more DNS RR types as unknown
The change drops buggy TSIG printing in the resolver and closes CVE-2026-5435.
Python debates PEP 842 module exports and public API boundaries
A proposed __export__ list would warn on access to non-public names, but reviewers want clearer ergonomics, internal-use rules, and stronger signals than warnings alone.
GCC bars most LLM-generated patches over copyright risk
The Steering Committee adopted a working-group policy that treats legally significant AI-written code as unacceptable, while leaving smaller assisted changes in a grey zone.
Git for Windows blocks NTLM hash leak via symlink probes
A patch skips type auto-detection for UNC symlink targets so clone no longer triggers silent SMB authentication.
Git RFC proposes external hunk providers for smarter diffs
A long-running process protocol would let tools like Difftastic decide which lines changed while Git keeps formatting, blame, and log -L.
LLVM plans dynamic vector shuffle intrinsic
An RFC for runtime-mask shuffles draws support from Rust, C++26, and SVE and RISC-V backends after years of workarounds.
Git maintainers push back on AI-written patches and replies
A show-branch refactoring drew sharp criticism after buggy revisions and chatbot-style mail suggested little human review.
glibc 2.40 backport plugs one-byte scanf %mc overflow
CVE-2026-5450 fixed a user-controlled overflow when %mc or %mC resized its allocated buffer.
Python PEP 841 frozen literals hit ordering and syntax pushback
A proposal for frozenset and frozendict display syntax draws fire over constant folding, the f-prefix, and whether the types are ready for first-class spelling.
SwiftNIO SSH patches unauthenticated stack write (CVE-2026-43798)
Version 0.14.1 fixes an ECDSA signature flaw that let remote attackers overwrite stack memory before any crypto check.