DefaultServeMux with net/http/pprof and expvar: accidental public exposure of debug endpoints

Direct answer

Yes. Importing net/http/pprof or expvar registers /debug/pprof/* and /debug/vars on http.DefaultServeMux during package initialization. Any server that uses that global mux serves those endpoints, so a public server bound to 0.0.0.0 exposes them to any external client. Binding to 127.0.0.1 or a Unix socket does not isolate them if the same http.DefaultServeMux is shared.

Confirmed facts and likely explanation

Item	Status
net/http/pprof and expvar register handlers on http.DefaultServeMux at package init	Confirmed
http.ListenAndServe(addr, nil) uses http.DefaultServeMux	Confirmed
Binding to 127.0.0.1 isolates by network interface, not by mux	Confirmed
A custom http.NewServeMux() does not receive automatic pprof or expvar registrations	Confirmed
Go 1.21+ changed pprof registration timing	Mark for review; exposure mechanism is similar

The likely explanation is that the public server passes nil as its handler, or otherwise shares http.DefaultServeMux, while a dependency or the application imports net/http/pprof for internal diagnostics. Because registration happens at init time, the exposure exists before any server starts.

Steps for this case

1. Search the module and dependencies for net/http/pprof and expvar imports:

grep -R "net/http/pprof\|expvar" --include="*.go" .

1. Create a dedicated mux for the public server instead of using the default:

mux := http.NewServeMux()
// register public routes only
server := &http.Server{Addr: "0.0.0.0:8080", Handler: mux}

1. If pprof is needed, run it on a separate admin server bound to 127.0.0.1 or a Unix socket with its own mux, never on the public mux.
2. Verify exposure from outside the host:

curl -s -o /dev/null -w "%{http_code}\n" http://example.com:8080/debug/pprof/

A 404 after the change confirms the public mux no longer serves debug handlers; a 200 means http.DefaultServeMux is still in use somewhere.

Assumptions and missing detail

This answer assumes the public server is created with http.ListenAndServe or http.Server and that you can change its handler. One missing diagnostic detail changes the recommendation: does any server in the process still pass nil as the handler, or otherwise reference http.DefaultServeMux? If no server uses the default mux, the exposure is already contained; if one does, replace that handler before exposing the port publicly.

Removing handlers from DefaultServeMux after registration is not recommended here because other dependencies may expect them. Prefer a custom mux for public traffic.