RHSA-2026:97191: Important: delve security, bug fix, and enhancement update
Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible.Security Fix(es): crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) Bug Fix(es) and Enhancement(s): Update Delve to 1.26 [rhel-10] (JIRA:RHEL-157418) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Additional Changes:For detailed information on changes in this release, see the Red Hat Enterprise Linux 10 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/delveto a version that resolves this vulnerability.Fixed in 1.26.1-2.el10 - Upgrade
Upgrade
redhat/delve-debuginfoto a version that resolves this vulnerability.Fixed in 1.26.1-2.el10 - Upgrade
Upgrade
redhat/delve-debugsourceto a version that resolves this vulnerability.Fixed in 1.26.1-2.el10 - Upgrade
Upgrade
redhat/delveto a version that resolves this vulnerability.Fixed in 1.26.1-2.el10.aa - Upgrade
Upgrade
redhat/delve-debuginfoto a version that resolves this vulnerability.Fixed in 1.26.1-2.el10.aa - Upgrade
Upgrade
redhat/delve-debugsourceto a version that resolves this vulnerability.Fixed in 1.26.1-2.el10.aa - Upgrade
Upgrade
Delveto a version that resolves this vulnerability.Fixed in 1.26
Event History
Frequently Asked Questions
Which systems are affected by this update?
The advisory applies to Red Hat Delve packages: delve, delve-debuginfo, and delve-debugsource. It includes an update of Delve to version 1.26 for RHEL 10.
What security issues are addressed?
The update addresses CVE-2026-33810, a certificate-validation bypass caused by incorrect DNS constraint application in Go crypto/x509, and CVE-2026-33811, a denial of service involving long CNAME responses in Go's net package LookupCNAME.