CVE-2026-55768
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
In GoAccess prior to version 1.11, the built-in WebSocket server narrows a 64-bit extended frame length into the signed 32-bit WSFrame.payloadlen field before enforcing the maximum frame size. An unauthenticated remote client can bypass the guard and force an approximately 18-exabyte allocation request that terminates the process.
Risk Assessment
The risk involves the possibility of remotely causing a denial of service by sending a crafted WebSocket frame, potentially disrupting the log analyzer's operation.
Recommendation
It is recommended to update GoAccess to version 1.11 or later, which includes a fix that properly checks the frame size before allocation.
Other vulnerabilities in GoAccess
See all- CVE-2026-55777Medium
GoAccess prior to version 1.11 contains a vulnerability in the parse_ios() function, which uses an attacker-controlled keyword-to-OS offset as both the source offset and copy length for memmove. This allows reading up to approximately 4 KB beyond the heap allocation and conditionally crashing GoAccess using a crafted User-Agent in a processed access log.
- CVE-2026-54715High
In GoAccess version 1.10.2, the parse_browser function assumes the matched browser token begins with 'Opera' and moves a trailing version substring to match plus five. This allows writing one to four attacker-influenced bytes beyond the heap allocation, potentially corrupting data or crashing GoAccess.
Original NVD description (English source)
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to version 1.11, the built-in WebSocket server narrows a 64-bit extended frame length into the signed 32-bit WSFrame.payloadlen field before enforcing the maximum frame size, allowing an unauthenticated remote client to bypass the guard and force an approximately 18-exabyte allocation request that terminates the process. This issue is fixed in version 1.11.