CVE-2026-55777 Details
Description
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to 1.11, the parse_ios() function uses an attacker-controlled keyword-to-OS offset as both the source offset and copy length for memmove, allowing a crafted User-Agent in a processed access log to read up to approximately 4 KB beyond the heap allocation and conditionally crash GoAccess. This issue is fixed in version 1.11.
A vulnerability exists in GoAccess versions prior to 1.11, specifically within the 'parse_ios()' function of 'opesys.c'. This issue arises because the function uses an attacker-controlled offset to read data from the heap, allowing a crafted User-Agent string to be exploited. The vulnerability enables an out-of-bounds heap read of approximately 4 KB per log line, leading to a conditional crash of the GoAccess application. The issue can be triggered by sending an HTTP request with a malicious User-Agent to a web server that logs the request and is later analyzed with GoAccess.
Users can upgrade to GoAccess version 1.11 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 30, 2026CISA-ADP
Assessed Jul 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/allinurl/goaccess/security/advisories/GHSA-5phr-qpgf-hgrg | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/allinurl/goaccess/commit/ba813ed97d998dbdcb8d87e178799a4bb2da9e81 | [email protected] | Source CodeVendor |
| https://github.com/allinurl/goaccess/security/advisories/GHSA-5phr-qpgf-hgrg | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| GoAccess | <= 1.10.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 31, 2026 | CVE Modified | CISA-ADP |
| Jul 30, 2026 | New CVE Received | [email protected] |