GoAccess vulnerabilities

GoAccess prior to version 1.11 contains a vulnerability in the parse_ios() function, which uses an attacker-controlled keyword-to-OS offset as both the source offset and copy length for memmove. This allows reading up to approximately 4 KB beyond the heap allocation and conditionally crashing GoAccess using a crafted User-Agent in a processed access log.

In GoAccess prior to version 1.11, the built-in WebSocket server narrows a 64-bit extended frame length into the signed 32-bit WSFrame.payloadlen field before enforcing the maximum frame size. An unauthenticated remote client can bypass the guard and force an approximately 18-exabyte allocation request that terminates the process.

In GoAccess version 1.10.2, the parse_browser function assumes the matched browser token begins with 'Opera' and moves a trailing version substring to match plus five. This allows writing one to four attacker-influenced bytes beyond the heap allocation, potentially corrupting data or crashing GoAccess.