Moderate Vulnerability in Go Toolset: Security Update for Delve and Golang Packages
Summary
ALSA-2025:22668: Moderate: go-toolset:rhel8 security update. Affects delve versions < 1.25.2-1.module_el8.10.0+4074+24330916. Fixed in 1.25.2-1.module_el8.10.0+4074+24330916. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Go Toolset is a collection of tools and libraries for the Go programming language, also known as Golang. It is widely used for building web servers, data pipelines, and other applications due to its efficiency and performance. This vulnerability affects several packages within the Go Toolset, including delve, golang, and others, which are essential for Go development and debugging.
Vulnerability Detail
The vulnerability arises from two main issues: first, an unexpected path returned from LookPath in the os/exec package (CVE-2025-47906), which could lead to security risks when executing commands. Second, the archive/tar package has an unbounded allocation issue when parsing GNU sparse maps (CVE-2025-58183), potentially leading to denial of service through resource exhaustion. These vulnerabilities can be exploited by attackers to manipulate the execution environment or exhaust system resources.
How To Fix
Minimum fixed version
1.25.2-1.module_el8.10.0+4074+24330916
This is the first release that contains the fix.
sudo dnf update delveTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, consider restricting the execution of commands that rely on the os/exec package or limit the input to the archive/tar package to prevent potential exploitation until the packages can be updated.
Conclusion
In summary, the Go Toolset has been identified with moderate vulnerabilities that could impact the security of applications built using it. It is crucial to update the affected packages to their patched versions to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for delve →
FAQ
The Go Toolset is a collection of tools and libraries for the Go programming language, used for building and managing Go applications.
Exploitation of these vulnerabilities could lead to unauthorized command execution or denial of service due to resource exhaustion.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without requiring signup.
Implement workarounds such as restricting command execution or limiting input to vulnerable packages until you can apply the updates.
Detailed information can be found on the CVE pages for CVE-2025-47906 and CVE-2025-58183.
Related vulnerabilities
Recent vulnerabilities recorded for delve.
