Summary
Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible.
Security Fix(es):
* crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)
* net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
Bug Fix(es) and Enhancement(s):
* Update Delve to 1.26 [rhel-10] (JIRA:Rocky Linux-157418)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.
Fixed packages 9
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 10 | delve | 0:1.26.1-2.el10_2 |
| Rocky Linux · 10 | delve | 0:1.26.1-2.el10_2 |
| Rocky Linux · 10 | delve | 0:1.26.1-2.el10_2 |
| Rocky Linux · 10 | delve-debuginfo | 0:1.26.1-2.el10_2 |
| Rocky Linux · 10 | delve-debuginfo | 0:1.26.1-2.el10_2 |
| Rocky Linux · 10 | delve-debuginfo | 0:1.26.1-2.el10_2 |
| Rocky Linux · 10 | delve-debugsource | 0:1.26.1-2.el10_2 |
| Rocky Linux · 10 | delve-debugsource | 0:1.26.1-2.el10_2 |
| Rocky Linux · 10 | delve-debugsource | 0:1.26.1-2.el10_2 |
Vulnerabilities 2
-
High 7.5
Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509
When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issu…
-
High 7.5
Crash when handling long CNAME response in net
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.