Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Delve packages may let attackers run code

published 1 month ago

Summary

The Delve tools for Red Hat can be tricked into executing malicious code. This could let an attacker take control of the system or steal data. Apply the latest Red Hat update for Delve, Delve‑debuginfo, and Delve‑debugsource as soon as possible.

What to do

Update redhat delve to version 0:1.26.1-1.el9_2.1.
Update redhat delve-debuginfo to version 0:1.26.1-1.el9_2.1.
Update redhat delve-debugsource to version 0:1.26.1-1.el9_2.1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_e4s:9.2::appstream	redhat	delve	< 0:1.26.1-1.el9_2.1 Fix: upgrade to 0:1.26.1-1.el9_2.1
Red Hat:rhel_e4s:9.2::appstream	redhat	delve-debuginfo	< 0:1.26.1-1.el9_2.1 Fix: upgrade to 0:1.26.1-1.el9_2.1
Red Hat:rhel_e4s:9.2::appstream	redhat	delve-debugsource	< 0:1.26.1-1.el9_2.1 Fix: upgrade to 0:1.26.1-1.el9_2.1

Original advisory text

Red Hat Security Advisory: delve security update

References

https://access.redhat.com/errata/RHSA-2026:67313 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2515815 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2515820 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2515827 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2515838 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2515839 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2515840 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67313.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-33818 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-33818 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-33818 Vendor Advisory
https://go.dev/cl/814980 Third Party Advisory
https://go.dev/issue/80405 Third Party Advisory
https://groups.google.com/g/golang-announce/c/94pEornpRlI Third Party Advisory
https://pkg.go.dev/vuln/GO-2026-5972 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-56853 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-56853 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-56853 Vendor Advisory
https://go.dev/cl/795540 Third Party Advisory
https://go.dev/issue/80205 Third Party Advisory
https://pkg.go.dev/vuln/GO-2026-6089 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-56858 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-56858 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-56858 Vendor Advisory
https://go.dev/cl/807100 Third Party Advisory
https://go.dev/issue/80435 Third Party Advisory
https://pkg.go.dev/vuln/GO-2026-6091 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-56859 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-56859 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-56859 Vendor Advisory
https://go.dev/cl/803320 Third Party Advisory
https://go.dev/issue/80481 Third Party Advisory
https://pkg.go.dev/vuln/GO-2026-6088 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-56860 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-56860 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-56860 Vendor Advisory
https://go.dev/cl/803681 Third Party Advisory
https://go.dev/issue/80494 Third Party Advisory
https://pkg.go.dev/vuln/GO-2026-6218 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-56862 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-56862 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-56862 Vendor Advisory
https://go.dev/cl/804261 Third Party Advisory
https://go.dev/issue/80528 Third Party Advisory
https://pkg.go.dev/vuln/GO-2026-6090 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

8.1 High

Timeline

Published15 Sep 2026

Updated15 Sep 2026

First seen15 Sep 2026

Sources

RHSA-2026:67313 · OSV

Track software like this

Free during beta