This advisory covers three security vulnerabilities in Delve and underlying Go libraries used by Red Hat Enterprise Linux 10. CVE-2025-61729 involves a denial of service caused by excessive resource consumption via a crafted certificate in crypto/x509. CVE-2025-61726 is a memory exhaustion vulnerability in the net/url package during query parameter parsing. CVE-2025-68121 concerns unexpected session resumption in crypto/tls. Red Hat has released updated Delve packages (version 1.25.2-2.el10_1) for multiple architectures to address these issues. The advisory references Red Hat Bugzilla entries for each CVE and provides links to updated packages and remediation instructions.

The vulnerabilities can lead to denial of service conditions through resource exhaustion or unexpected behavior in TLS session resumption, potentially impacting the stability and security of systems running Delve on affected Red Hat Enterprise Linux 10 versions. No known exploits in the wild have been reported. The issues affect the Go debugger and related cryptographic and URL parsing libraries, which may be used in debugging or development environments.

Red Hat has provided updated Delve packages that fix these vulnerabilities. Users should apply the security update for Delve version 1.25.2-2.el10_1 or later as provided in Red Hat Enterprise Linux 10 repositories. Detailed update instructions are available in the Red Hat advisory RHSA-2026:3864 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor.