A Lesson From My First CVE

In May 2024, for the first time (to my knowledge), a CVE ID was created for a security vulnerability which I accidentally introduced into a high-profile software project. This is it: CVE-2024-2757. I took some scant comfort in the fact that it was a denial-of-service vulnerability and not something worse, such as arbitrary code execution. Even so, this was unpleasant and I don’t wish to repeat the…