Skip to content
OpenAdvisories
Medium ALSA-2025:7466 3 CVEs

Moderate: delve and golang security update

Published May 13, 2025 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible.

Security Fix(es):

* golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints (CVE-2024-45341)
* golang: net/[http:](http:) net/[http:](http:) sensitive headers incorrectly sent after cross-domain redirect (CVE-2024-45336)
* crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec (CVE-2025-22866)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 8

ReleasePackageFixed in
AlmaLinux · 10 delve 1.24.1-1.el10_0
AlmaLinux · 10 go-toolset 1.23.7-1.el10_0.alma.1
AlmaLinux · 10 golang 1.23.7-1.el10_0.alma.1
AlmaLinux · 10 golang-bin 1.23.7-1.el10_0.alma.1
AlmaLinux · 10 golang-docs 1.23.7-1.el10_0.alma.1
AlmaLinux · 10 golang-misc 1.23.7-1.el10_0.alma.1
AlmaLinux · 10 golang-src 1.23.7-1.el10_0.alma.1
AlmaLinux · 10 golang-tests 1.23.7-1.el10_0.alma.1

Vulnerabilities 3

  • Medium 6.1
    CVE-2024-45336

    Sensitive headers incorrectly sent after cross-domain redirect in net/http

    The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subs…

    Go standard library net/http golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 6.1
    CVE-2024-45341

    Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509

    A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs whi…

    Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 4.0
    CVE-2025-22866

    Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec

    Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is en…

    Go standard library crypto/internal/nistec go zot Debian Ubuntu Alpine Wolfi Go

References

  • report
    https://access.redhat.com/security/cve/CVE-2024-45336
  • report
    https://access.redhat.com/security/cve/CVE-2024-45341
  • report
    https://access.redhat.com/security/cve/CVE-2025-22866
  • report
    https://bugzilla.redhat.com/2341750
  • report
    https://bugzilla.redhat.com/2341751
  • report
    https://bugzilla.redhat.com/2344219
  • advisory
    https://errata.almalinux.org/10/ALSA-2025-7466.html