Moderate Vulnerability in Delve Debugger: Security Update Required
Summary
RLSA-2026:19013: Moderate: delve security update. Affects delve versions < 0:1.26.1-1.el10_2. Fixed in 0:1.26.1-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Delve is a powerful debugger for the Go programming language, designed to provide a user-friendly debugging experience. It allows developers to inspect the state of their applications, set breakpoints, and evaluate expressions. However, recent security findings have revealed vulnerabilities that could lead to denial of service and memory exhaustion, impacting the reliability and security of applications using Delve.
Vulnerability Detail
The vulnerabilities identified in Delve stem from issues in the underlying Go libraries. Specifically, CVE-2025-61729 allows for denial of service due to excessive resource consumption when processing crafted certificates. CVE-2025-61726 can lead to memory exhaustion during query parameter parsing, while CVE-2025-68121 involves unexpected session resumption in TLS connections. These vulnerabilities can be exploited by malicious actors to disrupt service and compromise application performance.
How To Fix
Minimum fixed version
0:1.26.1-1.el10_2
This is the first release that contains the fix.
sudo dnf update delveTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the input size for certificates and query parameters to mitigate the risk of denial of service and memory exhaustion. Implementing strict validation checks on user inputs can also help reduce exposure to these vulnerabilities.
Conclusion
The vulnerabilities found in Delve pose significant risks to applications using this debugger. It is crucial to update to the latest patched version to mitigate these risks. Additionally, implementing input validation can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for delve →
FAQ
Delve is a debugger for the Go programming language, designed to help developers debug their applications efficiently.
The main vulnerabilities include denial of service due to excessive resource consumption, memory exhaustion during query parsing, and unexpected session resumption in TLS.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score for these vulnerabilities is 7.5, indicating a moderate level of severity.
Run 'sudo dnf update delve' in your terminal to update Delve to the fixed version 0:1.26.1-1.el10_2.
References
Related vulnerabilities
Recent vulnerabilities recorded for delve.
