Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

AlmaLinux Delve may let attackers forge web requests

published 1 year ago

Summary

The Delve debugging tool for the Go language, as provided for AlmaLinux, can misinterpret specially crafted web traffic, allowing an attacker to insert hidden requests into a normal connection. This could let the attacker bypass security checks, view or change data, or disrupt services. Install the latest Delve update from AlmaLinux or apply the vendor's patch to fix the issue.

What to do

Update almalinux delve to version 1.24.1-2.el10_0.

Affected software

Ecosystem	Vendor	Product	Affected versions
AlmaLinux:10	almalinux	delve	< 1.24.1-2.el10_0 Fix: upgrade to 1.24.1-2.el10_0

Original advisory text

Moderate: delve security update

Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible.

Security Fix(es):

* net/[http:](http:) Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

https://access.redhat.com/errata/RHSA-2025:9317 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2025-22871 Third Party Advisory
https://bugzilla.redhat.com/2358493 Third Party Advisory
https://errata.almalinux.org/10/ALSA-2025-9317.html Vendor Advisory

Timeline

Published23 Jun 2025

Updated29 Oct 2026

First seen29 Oct 2026

Sources

ALSA-2025:9317 · OSV

Track software like this

Free during beta