Critical Security Update for Delve: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:3864: Important: delve security update. Affects delve versions < 1.25.2-2.el10_1. Fixed in 1.25.2-2.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Delve is a powerful debugger designed for the Go programming language, enabling developers to inspect and control the execution of their Go programs. It aims to provide a user-friendly debugging experience, allowing developers to identify issues efficiently. However, recent vulnerabilities have been discovered that could compromise the security and stability of applications using Delve.
Vulnerability Detail
The vulnerabilities identified in Delve stem from issues in the underlying Go libraries. Specifically, these include a Denial of Service (DoS) vulnerability due to excessive resource consumption from crafted certificates (CVE-2025-61729), memory exhaustion during query parameter parsing (CVE-2025-61726), and unexpected session resumption in TLS (CVE-2025-68121). These vulnerabilities could lead to application crashes, service interruptions, and potential data exposure, making it critical for users to address them promptly.
How To Fix
Minimum fixed version
1.25.2-2.el10_1
This is the first release that contains the fix.
sudo dnf update delveTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the input size for certificates and query parameters to mitigate the risk of resource exhaustion. However, this is not a substitute for applying the official patch.
Conclusion
The recent vulnerabilities discovered in Delve highlight the importance of maintaining up-to-date software to protect against potential security threats. By updating to the latest patched version and utilizing tools like Vulert, developers can safeguard their applications effectively.
See every vulnerability recorded for delve →
FAQ
The main vulnerabilities include Denial of Service due to crafted certificates, memory exhaustion in query parameter parsing, and unexpected session resumption in TLS.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
These vulnerabilities can lead to application crashes, service interruptions, and potential data exposure, affecting the overall security and reliability of applications using Delve.
While the best course of action is to update to the patched version, you can temporarily limit input sizes for certificates and query parameters to reduce risk.
It is recommended to regularly check for updates and security advisories related to Delve and other dependencies to ensure your applications remain secure.
Related vulnerabilities
Recent vulnerabilities recorded for delve.
