Arc is an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 register Go's `net/http/pprof` handlers at `/debug/pprof/*` via `app.Use(pprof.New())` in `internal/api/server.go`, and `/debug/pprof` is added to `PublicPrefixes` in `cmd/arc/main.go`. The auth middleware short-circuits before the token check on prefix match, so the endpoints are reachable without any authentication. Version 26.06.1 contains a patch. Some workarounds are available. Block `/debug/pprof*` at a reverse proxy / load balancer in front of Arc, restrict Arc's API port to known-trusted networks via firewall rules, and/or patch the running build: comment out `app.Use(pprof.New())` in `internal/api/server.go` and rebuild.

Affected: Go: github.com/basekick-labs/arc

### Summary

Arc registers Go's `net/http/pprof` handlers at `/debug/pprof/*` via `app.Use(pprof.New())` in `internal/api/server.go`, and `/debug/pprof` is added to `PublicPrefixes` in `cmd/arc/main.go`. The auth middleware short-circuits before the token check on prefix match, so the endpoints are reachable without any authentication.

### Impact

Any network-reachable caller (no token required) can:

- Fetch `/debug/pprof/heap` — leaks in-memory state: live SQL strings, decoded msgpack records, decompressed request bodies, cached `*TokenInfo` (the auth cache keys on SHA-256 of the plaintext token at `auth.go:543`). - Fetch `/debug/pprof/goroutine?debug=2` — leaks call stacks, identifying internal code paths. - Fetch `/debug/pprof/profile?seconds=N` — pins a CPU core for arbitrary duration. Trivial DoS amplification (one short HTTP request → minutes of server CPU). - Fetch `/debug/pprof/trace` — long-duration execution trace, similar DoS profile.

No authentication, no rate limiting, no resource bound on the `seconds` parameter.

### Patches

https://github.com/Basekick-Labs/arc/releases/tag/v26.06.1

Planned mitigation:

1. Gate pprof registration behind an env var (`ARC_DEBUG_PPROF=1`) that defaults to off. 2. When enabled, bind pprof to a separate localhost-only listener (`127.0.0.1:6060` via dedicated `net/http` server) so it's never reachable from the public API port. 3. Remove `/debug/pprof` from `PublicPrefixes`. 4. Fix the `HasPrefix` bug where `"/debug/pprofX"` mat…

brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization github.com/moby/go-archive: moby/go-archive: Arbitrary file write via link following in tar extraction crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation baseline-browser-mapping: baseline-browser-mapping: Denial of Service via improper input handling oras-go: oras-go: File store write outside working directory via symlink traversal net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service html/template: golang: Go html/template: Cross-Site Scripting via pathological input encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages js-yaml: js-yaml: Denial of Service via crafted YAML documents brace-expansion: DoS via unbounded inter…