Red Hat Security Advisory

RHSA-2025:3773

delve and golang security update

Released 2025-04-10 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) delve-1.24.1-2.el9_5, go-toolset-1.23.6-2.el9_5, golang-1.23.6-2.el9_5 +6

Fixes 4 records

TI-2024-22606 CVE-2024-34156 · GHSA-crqm-pwhx-j97f

Stack exhaustion in Decoder.Decode in encoding/gob

MEDIUM 41

Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01127 Published 2024-09-06 Partial fix · 1.22.7, 1.23.1

TI-2024-30411 CVE-2024-45341 · GHSA-3f6r-qh9c-x6mm

Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509

LOW 28

A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00556 Published 2025-01-28 Partial fix · 1.22.11, 1.23.5 +1

TI-2024-30406 CVE-2024-45336 · GHSA-7wrw-r4p8-38rx

Sensitive headers incorrectly sent after cross-domain redirect in net/http

LOW 28

The HTTP client drops sensitive headers after following a cross-domain redirect.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0071 Published 2025-01-28 Partial fix · 1.22.11, 1.23.5 +1

TI-2025-16738 CVE-2025-22866 · GHSA-3whm-j4xm-rv8x

Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec

LOW 19

Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture.

CVSS 3.1MEDIUM 4.0 Local No auth No interaction EPSS 0.0029 Published 2025-02-06 Partial fix · 1.22.12, 1.23.6 +1