Go/github.com/basekick-labs/arc CVE-2026-48050: high, EPSS 0.64%
Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS
Action: Upgrade github.com/basekick-labs/arc to 0.0.0-20260520170331-32a4091fb949 or later.
go get github.com/basekick-labs/arc@v0.0.0-20260520170331-32a4091fb949Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | - |
Fixed versions
| 0.0.0-20260520170331-32a4091fb949 |
Sources
- osv: GHSA-j93g-rp6m-j32m
- https://github.com/Basekick-Labs/arc/security/advisories/GHSA-j93g-rp6m-j32m
- https://github.com/Basekick-Labs/arc/commit/32a4091fb949f9cf060cdd804a07f6450dc426a8
- https://github.com/Basekick-Labs/arc
- https://github.com/Basekick-Labs/arc/releases/tag/v26.06.1
CVE-2026-48050 · published · modified · JSON