CVE-2026-48050: Unauthenticated Access to Go Debug Pprof Endpoints in Arc Leads to Runtime State Leakage and CPU-Burn DoS
Summary
CVE-2026-48050: Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS. Affects github.com/basekick-labs/arc versions < 0.0.0-20260520170331-32a4091fb949. Fixed in 0.0.0-20260520170331-32a4091fb949. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Arc is an open-source Go application that provides various functionalities, including API services. It utilizes Go's net/http/pprof package for profiling and debugging purposes. However, due to a misconfiguration in its authentication middleware, certain debug endpoints are exposed without authentication, making them vulnerable to unauthorized access.
Vulnerability Detail
The vulnerability arises from the registration of Go's net/http/pprof handlers at /debug/pprof/* without proper authentication checks. This allows any network-reachable caller to access sensitive runtime information, such as in-memory state, call stacks, and the ability to pin CPU cores for extended periods, leading to potential Denial of Service (DoS) attacks. The lack of rate limiting and resource constraints on the parameters exacerbates the risk, making it easy for attackers to exploit the endpoints.
How To Fix
Latest published version: v25.11.2+incompatible as of 22 Oct 2026
go get github.com/basekick-labs/arc@v25.11.2+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.0.0-20260520170331-32a4091fb949
This is the first release that contains the fix.
go get github.com/basekick-labs/arc@v0.0.0-20260520170331-32a4091fb949Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, block access to /debug/pprof* at a reverse proxy or load balancer in front of Arc. Additionally, restrict Arc's API port to known-trusted networks using firewall rules. Alternatively, you can patch the running build by commenting out the line app.Use(pprof.New()) in internal/api/server.go and rebuilding the application.
Conclusion
CVE-2026-48050 presents a significant security risk for users of the Arc application due to unauthenticated access to sensitive debug endpoints. It is crucial to apply the available patch or implement workarounds to mitigate the risk of exploitation.
See every vulnerability recorded for github.com/basekick-labs/arc →
FAQ
CVE-2026-48050 is a vulnerability in the Arc application that allows unauthenticated access to Go debug pprof endpoints, leading to potential information leakage and Denial of Service attacks.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities without requiring any signup.
The impacts include unauthorized access to sensitive runtime information, potential DoS attacks by pinning CPU resources, and exposure of internal code paths.
Yes, a patch is available in version 0.0.0-20260520170331-32a4091fb949 of the Arc package. Updating to this version will mitigate the vulnerability.
If you cannot update immediately, implement the suggested workarounds, such as blocking access to the vulnerable endpoints and restricting API access to trusted networks.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/basekick-labs/arc.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.