Moderate Vulnerability in Delve Debugger: Security Update Required
Summary
ALSA-2026:3842: Moderate: delve security update. Affects delve versions < 1.25.2-2.el9_7. Fixed in 1.25.2-2.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Delve is a powerful debugger designed for the Go programming language, aimed at providing developers with a simple yet full-featured debugging tool. It allows developers to inspect and control the execution of Go programs, making it easier to identify and resolve issues during development. However, Delve has recently been found to have a security vulnerability that could impact its functionality and security.
Vulnerability Detail
The vulnerability arises from an unexpected session resumption in the crypto/tls package, identified as CVE-2025-68121. This issue could potentially allow unauthorized access to sensitive data during TLS sessions, leading to security breaches. The vulnerability is particularly concerning for applications that rely on secure communications, as it undermines the integrity of the encryption process.
How To Fix
Minimum fixed version
1.25.2-2.el9_7
This is the first release that contains the fix.
sudo dnf update delveTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the patched version as soon as possible.
Conclusion
In summary, the Delve debugger has a moderate vulnerability that requires immediate attention. Users are advised to update to the latest patched version to ensure the security of their applications. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the integrity of your software.
See every vulnerability recorded for delve →
FAQ
The vulnerability is related to an unexpected session resumption in the crypto/tls package, which could allow unauthorized access to sensitive data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Update the Delve package to the latest patched version (1.25.2-2.el9_7) to mitigate the vulnerability.
Yes, failing to update could expose your application to potential security breaches, as the vulnerability allows unauthorized access to sensitive data.
For more details, refer to the CVE page associated with CVE-2025-68121, which provides in-depth information about the security issue.
Related vulnerabilities
Recent vulnerabilities recorded for delve.
