CVE-2026-48050: Unauthenticated Access to Go Debug Pprof Endpoints in github.com/basekick-labs/arc
Summary
CVE-2026-48050: Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS in github.com/basekick-labs/arc. Affects github.com/basekick-labs/arc versions < 0.0.0-20260520170331-32a4091fb949. Fixed in 0.0.0-20260520170331-32a4091fb949. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The package 'github.com/basekick-labs/arc' is a Go-based library designed for building scalable applications. It provides various functionalities, including performance monitoring and debugging tools. However, it has been found to have vulnerabilities that allow unauthorized access to sensitive runtime information, which could lead to denial-of-service attacks.
Vulnerability Detail
The vulnerability arises from unauthenticated access to Go debug pprof endpoints within the 'arc' package. This flaw allows attackers to exploit the runtime state of the application, potentially leading to CPU-burn denial-of-service (DoS) attacks. The lack of authentication means that any user can access these endpoints, exposing critical information that could be used for further exploitation.
How To Fix
Latest published version: v25.11.2+incompatible as of 22 Oct 2026
go get github.com/basekick-labs/arc@v25.11.2+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.0.0-20260520170331-32a4091fb949
This is the first release that contains the fix.
go get github.com/basekick-labs/arc@v0.0.0-20260520170331-32a4091fb949Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the pprof endpoints by implementing authentication mechanisms or by disabling the pprof endpoints entirely until the package is updated. This can be done by modifying your application’s configuration to limit access to trusted users only.
Conclusion
The vulnerability CVE-2026-48050 in the 'github.com/basekick-labs/arc' package poses significant risks due to unauthenticated access to critical debugging endpoints. It is crucial to update to the latest patched version to mitigate these risks and ensure the security of your application.
See every vulnerability recorded for github.com/basekick-labs/arc →
FAQ
CVE-2026-48050 is a vulnerability in the 'github.com/basekick-labs/arc' package that allows unauthenticated access to Go debug pprof endpoints.
Pprof endpoints are debugging tools in Go that provide insights into the performance of applications, including memory and CPU usage.
This vulnerability can lead to unauthorized access to sensitive runtime information and may allow attackers to execute denial-of-service attacks by consuming CPU resources.
Yes, a patched version of the 'arc' package is available. Updating to version '0.0.0-20260520170331-32a4091fb949' will resolve the issue.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/basekick-labs/arc.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.