RLSA-2026:97191: High severity rocky-linux/delve-debugsource vulnerability
Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible.
Security Fix(es):
crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)
net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
Bug Fix(es) and Enhancement(s):
Update Delve to 1.26 [rhel-10] (JIRA:Rocky Linux-157418)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/delve-debugsourceto a version that resolves this vulnerability.Fixed in 0:1.26.1-2.el10_2 - Upgrade
Upgrade
rocky-linux/delve-debuginfoto a version that resolves this vulnerability.Fixed in 0:1.26.1-2.el10_2 - Upgrade
Upgrade
rocky-linux/delveto a version that resolves this vulnerability.Fixed in 0:1.26.1-2.el10_2 - Upgrade
Upgrade
Delveto a version that resolves this vulnerability.Fixed in 1.26
Event History
Frequently Asked Questions
Which Rocky Linux packages are covered by this advisory?
The advisory lists delve, delve-debuginfo, and delve-debugsource packages for Rocky Linux.
What action is provided to address the reported security issues?
The release updates Delve to version 1.26 for RHEL 10. Apply the Rocky Linux update for the listed Delve packages.
Which security issues are included in this update?
The update includes fixes for CVE-2026-33810, a crypto/x509 certificate-validation bypass involving DNS constraints, and CVE-2026-33811, a denial of service involving long CNAME responses in net.LookupCNAME.