Back Linuxsecurity

Fedora 43: Investigating Critical CVE-2025

Linuxsecurity •LinuxSecurity Advisories • January 1, 2026

Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible. Update Information : Support for Go 1.26 and security fixes. Upstream release notes.

Delve is a debugger for the Go programming language. The goal of the project

is to provide a simple, full featured debugging tool for Go. Delve should be

easy to invoke and easy to use. Chances are if you're using a debugger, things

aren't going your way. With that in mind, Delve should stay out of your way as

Support for Go 1.26 and security fixes. Upstream release notes.

* Fri Dec 19 2025 Packit - 1.26.0-1 - Update to 1.26.0 upstream release * Fri Oct 10 2025 Alejandro Sez - 1.25.2-2 - rebuild

[ 1 ] Bug #2399350 - CVE-2025-47906 delve: Unexpected paths returned from LookPath in os/exec [fedora-42] [ 2 ] Bug #2407876 - CVE-2025-58189 delve: go crypto/tls ALPN negotiation error contains attacker controlled information [fedora-42] [ 3 ] Bug #2408153 - CVE-2025-58189 delve: go crypto/tls ALPN negotiation error contains attacker controlled information [fedora-43] [ 4 ] Bug #2409344 - CVE-2025-61723 delve: Quadratic complexity when parsing some invalid inputs in encoding/pem [fedora-42] [ 5 ] Bug #2409623 - CVE-2025-61723 delve: Quadratic complexity when parsing some invalid inputs in encoding/pem [fedora-43] [ 6 ] Bug #2410295 - CVE-2025-58185 delve: Parsing DER payload ... Read the Full Advisory

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-3591ae9dd3' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fedora Releases Critical Fixes for Delve Debugger Vulnerabilities Fedora has released critical memory exhaustion fixes for the Delve debugger used in Go programming. The updates include support for Go 1.26 and address security vulnerabilities identified as CVE-2025. Users of Fedora 42 and Fedora 43 are advised to apply these updates to mitigate potential risks. 2 sources 38

Extracted Entities

CVEs (4)

CVE-2025-47906 CVE-2025-58185 CVE-2025-58189 CVE-2025-61723