Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Basekick-Labs | arc | affected |
|
No data.
No data.
| Vendor | Product | Versions | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Basekick-labs | Arc |
|
| Source | ID | Title |
|---|---|---|
Github GHSA |
GHSA-j93g-rp6m-j32m | Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS |
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.887% probability within 30 days)
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
cvssV3_1
|
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Basekick-labs
Basekick-labs arc |
|
| Vendors & Products |
Basekick-labs
Basekick-labs arc |
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Arc is an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 register Go's `net/http/pprof` handlers at `/debug/pprof/*` via `app.Use(pprof.New())` in `internal/api/server.go`, and `/debug/pprof` is added to `PublicPrefixes` in `cmd/arc/main.go`. The auth middleware short-circuits before the token check on prefix match, so the endpoints are reachable without any authentication. Version 26.06.1 contains a patch. Some workarounds are available. Block `/debug/pprof*` at a reverse proxy / load balancer in front of Arc, restrict Arc's API port to known-trusted networks via firewall rules, and/or patch the running build: comment out `app.Use(pprof.New())` in `internal/api/server.go` and rebuild. | |
| Title | Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS | |
| Weaknesses | CWE-200 CWE-306 CWE-400 |
|
| References |
| |
| Metrics |
cvssV4_0
|
View source · Bugzilla · JSON
OpenCVE enrichment
Updated: Aug 23, 2026, 4:40 PM
Github GHSA