CVE-2026-54715
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
In GoAccess version 1.10.2, the parse_browser function assumes the matched browser token begins with 'Opera' and moves a trailing version substring to match plus five. This allows writing one to four attacker-influenced bytes beyond the heap allocation, potentially corrupting data or crashing GoAccess.
Risk Assessment
The risk involves the possibility of remote memory corruption and crash of the log analyzer via a crafted User-Agent header, potentially leading to denial of service or potential code execution.
Recommendation
Update GoAccess to version 1.11 or later, which includes a fix preventing out-of-bounds read in the parse_browser function.
Other vulnerabilities in GoAccess
See all- CVE-2026-55777Medium
GoAccess prior to version 1.11 contains a vulnerability in the parse_ios() function, which uses an attacker-controlled keyword-to-OS offset as both the source offset and copy length for memmove. This allows reading up to approximately 4 KB beyond the heap allocation and conditionally crashing GoAccess using a crafted User-Agent in a processed access log.
- CVE-2026-55768High
In GoAccess prior to version 1.11, the built-in WebSocket server narrows a 64-bit extended frame length into the signed 32-bit WSFrame.payloadlen field before enforcing the maximum frame size. An unauthenticated remote client can bypass the guard and force an approximately 18-exabyte allocation request that terminates the process.
Original NVD description (English source)
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. In version 1.10.2, parse_browser assumes the matched browser token begins with Opera and moves a trailing version substring to match plus five, allowing a crafted User-Agent in a processed access log to write one to four attacker-influenced bytes beyond the heap allocation and corrupt or crash GoAccess. This issue is fixed in version 1.11.