ClickHouse SQLi and QEMU security, machine, and binary work

Security disclosures and fixes led Databases and Infrastructure traffic, with ClickHouse reporting a dictionary-source injection issue and QEMU merging websocket denial-of-service patches. Parallel QEMU series advanced QOM introspection, Arm confidential computing, RP2040 machine support, and single-binary packaging.

ClickHouse MySQL/XDBC dictionary SQL injection

ClickHouse reported a SQL injection flaw in MySQL and XDBC dictionary sources that skips query type validation. The issue is framed as a sibling of CVE-2026-51992 and can enable remote code execution. Operators who load external dictionaries should prioritize review and mitigation of this path.

QEMU merges websocket DoS and misc fixes

A misc-fixes pull for QEMU lands patches for multiple websocket denial-of-service vulnerabilities tracked as CVE-2026-84788. The same series deprecates the AF_ALG crypto backend and tightens x509 error handling. The changes matter for hosts that expose websocket display or related network front ends.

QOM/qdev properties linked to QAPI schema types

A 75-patch series associates QOM and qdev properties with QAPI schema types to strengthen introspection. The work spans core infrastructure and a large file set. Clearer schema binding would help configuration tooling and validation for complex machine models.

Raspberry Pi Pico and RP2040 machine in QEMU

An RFC v2 series of roughly 30 patches adds an RP2040 and Raspberry Pi Pico machine, covering dual Cortex-M0+ cores, boot ROM, peripherals, and TCG tests. Embedded developers gain a fuller system-emulation path for that MCU family. Several reviewers are iterating on the machine model and test coverage.

Arm Realm support for QEMU-VMM

RFC v4 proposes Realm (Arm RME) confidential VM support in QEMU-VMM, aligned with recent KVM CCA work. Confidential computing on Arm still needs matching VMM plumbing beyond the kernel. The series keeps QEMU in step with hardware and CCA enablement.

Single-binary qemu-system for ARM and RISC-V

Related patch sets try to fold ARM and RISC-V into one qemu-system binary, including dynamic QOM type filtering for target and Kconfig constraints. Reviewers pushed back on build mechanics and command-line impact. The thread reflects ongoing tension between packaging simplicity and multi-architecture compatibility.