Moderate Security Update for Delve: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:19013: Moderate: delve security update. Affects delve versions < 1.26.1-1.el10_2. Fixed in 1.26.1-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Delve is a powerful debugger designed for the Go programming language, aimed at providing a user-friendly debugging experience. It allows developers to inspect their code, set breakpoints, and analyze program execution. However, recent vulnerabilities have been identified that could compromise its security and performance, particularly in handling certificates and network URLs.
Vulnerability Detail
The vulnerabilities in Delve stem from issues in the Go programming language's libraries. Specifically, CVE-2025-61729 allows for Denial of Service attacks due to excessive resource consumption when processing crafted certificates. CVE-2025-61726 leads to memory exhaustion during query parameter parsing in the net/url package. Additionally, CVE-2025-68121 involves unexpected session resumption in the crypto/tls package, which could lead to security breaches. These vulnerabilities can severely impact application performance and security, making it crucial for users to address them promptly.
How To Fix
Minimum fixed version
1.26.1-1.el10_2
This is the first release that contains the fix.
sudo dnf update delveTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the input size for certificates and query parameters to mitigate the risk of Denial of Service and memory exhaustion attacks. However, this is not a permanent solution and updating the package is strongly recommended.
Conclusion
In summary, the recent vulnerabilities identified in Delve pose significant risks to applications using this debugger. Users are strongly encouraged to update to the latest patched version to ensure their applications remain secure and performant. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for delve →
FAQ
Delve is a debugger for the Go programming language, designed to provide an easy-to-use interface for debugging Go applications.
The main vulnerabilities include Denial of Service due to excessive resource consumption, memory exhaustion in query parameter parsing, and unexpected session resumption in TLS.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
While limiting input sizes can help, it is not a permanent solution. Updating to the patched version is the best way to ensure security.
For more details, refer to the CVE pages listed in the vulnerability report, which provide in-depth information about each issue.
Related vulnerabilities
Recent vulnerabilities recorded for delve.
