Critical Security Flaw in Delve Debugger: Denial of Service and Memory Exhaustion Vulnerabilities
Summary
RLSA-2026:3864: Important: delve security update. Affects delve versions < 0:1.25.2-2.el10_1. Fixed in 0:1.25.2-2.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Delve is a powerful debugger designed for the Go programming language, aimed at providing developers with a simple yet comprehensive tool for debugging applications. It allows users to inspect variables, set breakpoints, and navigate through code execution. However, recent vulnerabilities have been identified that could lead to severe security issues, including denial of service and memory exhaustion, impacting the stability and performance of applications using this tool.
Vulnerability Detail
The vulnerabilities in Delve stem from issues in its underlying libraries. Specifically, CVE-2025-61729 allows for denial of service due to excessive resource consumption when handling crafted certificates. CVE-2025-61726 leads to memory exhaustion during query parameter parsing in the net/url package. Additionally, CVE-2025-68121 presents an unexpected session resumption issue in the crypto/tls package. These vulnerabilities could allow attackers to exploit the debugger, potentially crashing applications or consuming excessive system resources.
How To Fix
Minimum fixed version
0:1.25.2-2.el10_1
This is the first release that contains the fix.
sudo dnf update delveTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the input size for certificates and query parameters to mitigate the risk of denial of service and memory exhaustion. Implementing strict validation checks on incoming data can also help reduce exposure to these vulnerabilities.
Conclusion
In summary, the Delve debugger has critical vulnerabilities that require immediate attention. Updating to the latest patched version is essential to safeguard applications from potential attacks. Additionally, implementing workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for delve →
FAQ
The CVSS score for these vulnerabilities is 7.5, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The vulnerabilities could lead to denial of service, causing applications to crash, or memory exhaustion, which can degrade performance and stability.
Yes, implementing strict validation checks on input data and limiting the size of certificates and query parameters can help mitigate risks temporarily.
For detailed information, you can refer to the CVE pages associated with the vulnerabilities: CVE-2025-61726, CVE-2025-61729, and CVE-2025-68121.
References
Related vulnerabilities
Recent vulnerabilities recorded for delve.
