{"id":"GO-2026-5457","revision":"c7dcf021381e4056baeb590078840f49","records":[{"revision":"c7dcf021381e4056baeb590078840f49","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5457","aliases":["CVE-2026-48050","GHSA-j93g-rp6m-j32m"],"title":"Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS in github.com/basekick-labs/arc","description":"Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS in github.com/basekick-labs/arc","state":0,"publishedAt":"2026-06-25T22:34:31+00:00","modifiedAt":"2026-06-25T23:01:18.2411655+00:00","affected":[{"ecosystem":"Go","name":"github.com/basekick-labs/arc","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260520170331-32a4091fb949"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/Basekick-Labs/arc/security/advisories/GHSA-j93g-rp6m-j32m","https://github.com/Basekick-Labs/arc/commit/32a4091fb949f9cf060cdd804a07f6450dc426a8","https://github.com/Basekick-Labs/arc/releases/tag/v26.06.1"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5457","license":"OSV · upstream source license applies","key":"osv:GO-2026-5457","identifiers":["GO-2026-5457","CVE-2026-48050","GHSA-j93g-rp6m-j32m"]},"retained":false,"historicalAffected":[]}],"coverage":[]}