275 messages in 20 days: oss-sec list floods with Apache CVEs
DanielLockyer · x · 2026-10-21
DanielLockyer checked the oss-sec mailing list and found 275 messages between Oct 1–20 — "must be fun to be in cybersecurity atm." Disclosures on Oct 1 alone include a string of Apache APISIX issues (unauthenticated impersonation in saml-auth, session fixation in feishu/dingtalk-auth plugins, data-mask failing to redact headers, cross-request permission pollution, route/upstream authorization mismatch, openid-connect introspection flaw, memory exhaustion via batch response aggregation), multiple Apache HTTP Server CVEs (limited RCE via internal redirects to non-CGI files, moddav shared lock overflow, modsession cookie not cleared), Apache Camel Quarkus TransformerFactory hardening dropped, and two heap overflows in Perl's Imager library.
Related event: Open-Source Vulnerability Flood: 275 Security Advisories in 20 Days(2 posts)→
More from Infra
- Uncensored DeepSeek V4.1 Flash GGUFs drop refusal rate from 91.4% to 0% with minimal MMLU loss — kalyan_kpl · 2026-10-21
- Specter speeds single-GPU MoE inference with quantized multi-step speculative offloading — Wenfeng Wang · 2026-10-21
- SpaceX reportedly targeting 13 GWh of compute by EOY 2027; Grok bots for businesses in weeks — elonmusk · 2026-10-21
- Meta engineer confirms Google TPUs now run AI inference in Meta production — dotey · 2026-10-21
- OmniGraph Open-Sourced: Git-Style Branches and Merges for AI Agent Memory — techNmak · 2026-10-21
- Running Qwen3.8 for agentic coding on 2x5090: vLLM is the only stack that doesn't trash the cache — TooManyPascals · 2026-10-21