CVE-2026-55768 Details
Description
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to version 1.11, the built-in WebSocket server narrows a 64-bit extended frame length into the signed 32-bit WSFrame.payloadlen field before enforcing the maximum frame size, allowing an unauthenticated remote client to bypass the guard and force an approximately 18-exabyte allocation request that terminates the process. This issue is fixed in version 1.11.
A denial-of-service vulnerability has been identified in GoAccess versions prior to 1.11. The issue arises in the built-in WebSocket server, which is active when the real-time HTML option is enabled. The server improperly handles the payload length of WebSocket frames, truncating a 64-bit length into a signed 32-bit integer. This flaw allows an unauthenticated remote client to send a crafted frame that bypasses the maximum size check, leading to an excessive memory allocation request of approximately 18 exabytes. The allocation failure causes the process to terminate, disrupting the live reporting service and disconnecting all active dashboard viewers.
Users can upgrade to GoAccess version 1.11 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 30, 2026CISA-ADP
Assessed Jul 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/allinurl/goaccess/security/advisories/GHSA-5gm5-pvh2-wg46 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/allinurl/goaccess/commit/ea74b87254d0adc675c087ff49bddd2d60dc01d5 | [email protected] | Source CodeVendor |
| https://github.com/allinurl/goaccess/security/advisories/GHSA-5gm5-pvh2-wg46 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-681 | Incorrect Conversion between Numeric Types | [email protected] |
| CWE-789 | Memory Allocation with Excessive Size Value | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| GoAccess | <= 2.3.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 31, 2026 | CVE Modified | CISA-ADP |
| Jul 30, 2026 | New CVE Received | [email protected] |