CVE-2026-48050

Name of the Vulnerable Software and Affected Versions Arc versions prior to 26.06.1

Description Arc registers Go net/http/pprof handlers at the /debug/pprof/* endpoint. Due to a configuration where /debug/pprof is added to PublicPrefixes and the authentication middleware short-circuits before token verification on prefix matches, these endpoints are accessible without authentication. This allows network-reachable callers to leak in-memory state, including live SQL strings, decoded msgpack records, decompressed request bodies, and cached *TokenInfo via the /debug/pprof/heap endpoint. Additionally, the /debug/pprof/goroutine?debug=2 endpoint leaks call stacks. The /debug/pprof/profile?seconds=N and /debug/pprof/trace endpoints can be used to cause a Denial of Service (DoS) by pinning a CPU core for an arbitrary duration via the seconds parameter, which lacks resource bounds and rate limiting.

Recommendations Update to version 26.06.1. Block /debug/pprof* at a reverse proxy or load balancer in front of Arc. Restrict Arc API port access to known-trusted networks using firewall rules. Comment out app.Use(pprof.New()) in internal/api/server.go and rebuild the application.