Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-48050 · Microsoft / collected KEV context

EUVD-2026-64190

GHSA-j93g-rp6m-j32m

GO-2026-5457

cve-program · CVE-2026-48050

• https://github.com/Basekick-Labs/arc/security/advisories/GHSA-j93g-rp6m-j32m
• https://github.com/Basekick-Labs/arc/commit/32a4091fb949f9cf060cdd804a07f6450dc426a8
• https://github.com/Basekick-Labs/arc/releases/tag/v26.06.1

euvd · EUVD-2026-64190

• https://github.com/Basekick-Labs/arc/security/advisories/GHSA-j93g-rp6m-j32m
• https://github.com/Basekick-Labs/arc/commit/32a4091fb949f9cf060cdd804a07f6450dc426a8
• https://github.com/Basekick-Labs/arc/releases/tag/v26.06.1

nvd · CVE-2026-48050

• https://github.com/Basekick-Labs/arc/commit/32a4091fb949f9cf060cdd804a07f6450dc426a8
• https://github.com/Basekick-Labs/arc/releases/tag/v26.06.1
• https://github.com/Basekick-Labs/arc/security/advisories/GHSA-j93g-rp6m-j32m

osv · GHSA-j93g-rp6m-j32m

• https://github.com/Basekick-Labs/arc/security/advisories/GHSA-j93g-rp6m-j32m
• https://github.com/Basekick-Labs/arc/commit/32a4091fb949f9cf060cdd804a07f6450dc426a8
• https://github.com/Basekick-Labs/arc
• https://github.com/Basekick-Labs/arc/releases/tag/v26.06.1

osv · GO-2026-5457

• https://github.com/Basekick-Labs/arc/security/advisories/GHSA-j93g-rp6m-j32m
• https://github.com/Basekick-Labs/arc/commit/32a4091fb949f9cf060cdd804a07f6450dc426a8
• https://github.com/Basekick-Labs/arc/releases/tag/v26.06.1

No related operational record is retained in the current change model.