CVE-2026-55777
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
GoAccess prior to version 1.11 contains a vulnerability in the parse_ios() function, which uses an attacker-controlled keyword-to-OS offset as both the source offset and copy length for memmove. This allows reading up to approximately 4 KB beyond the heap allocation and conditionally crashing GoAccess using a crafted User-Agent in a processed access log.
Risk Assessment
The organization risks heap memory data leakage and GoAccess crashes, which could disrupt log analysis and security monitoring.
Recommendation
Update GoAccess to version 1.11 or later, which includes a fix that validates the offset and copy length.
Other vulnerabilities in GoAccess
See all- CVE-2026-55768High
In GoAccess prior to version 1.11, the built-in WebSocket server narrows a 64-bit extended frame length into the signed 32-bit WSFrame.payloadlen field before enforcing the maximum frame size. An unauthenticated remote client can bypass the guard and force an approximately 18-exabyte allocation request that terminates the process.
- CVE-2026-54715High
In GoAccess version 1.10.2, the parse_browser function assumes the matched browser token begins with 'Opera' and moves a trailing version substring to match plus five. This allows writing one to four attacker-influenced bytes beyond the heap allocation, potentially corrupting data or crashing GoAccess.
Original NVD description (English source)
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to 1.11, the parse_ios() function uses an attacker-controlled keyword-to-OS offset as both the source offset and copy length for memmove, allowing a crafted User-Agent in a processed access log to read up to approximately 4 KB beyond the heap allocation and conditionally crash GoAccess. This issue is fixed in version 1.11.