Is github.com/basekick-labs/arc affected by CVE-2026-48050?

Go github.com/basekick-labs/arc is affected in <0.0.0-20260520170331-32a4091fb949.

Is CVE-2026-48050 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.4%.

high

CVE-2026-48050

Q: Is CVE-2026-48050 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.4%.

Go · github.com/basekick-labs/arc

Summary

Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS

Severity: high
EPSS: 0.4% (p29)
Also known as: GHSA-j93g-rp6m-j32m
Published: 2026-06-11

References

https://github.com/Basekick-Labs/arc/security/advisories/GHSA-j93g-rp6m-j32m
https://github.com/Basekick-Labs/arc/commit/32a4091fb949f9cf060cdd804a07f6450dc426a8
https://github.com/Basekick-Labs/arc

Related advisories

CVE-2026-47735 — high · Go/github.com/basekick-labs/arc
CVE-2026-55678 — medium · Go/github.com/basekick-labs/arc

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.