CVE-2026-55768

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to version 1.11, the built-in WebSocket server narrows a 64-bit extended frame length into the signed 32-bit WSFrame.payloadlen field before enforcing the maximum frame size, allowing an unauthenticated remote client to bypass the guard and force an approximately 18-exabyte allocation request that terminates the process. This issue is fixed in version 1.11.

CVSS

No CVSS.

References

Link	Resource
https://github.com/allinurl/goaccess/commit/ea74b87254d0adc675c087ff49bddd2d60dc01d5
https://github.com/allinurl/goaccess/security/advisories/GHSA-5gm5-pvh2-wg46
https://github.com/allinurl/goaccess/security/advisories/GHSA-5gm5-pvh2-wg46

Configurations

No configuration.

History

23 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) GoAccess es un analizador de registros web en tiempo real y visor interactivo que se ejecuta en una terminal en sistemas nix o a través del navegador. Antes de la versión 1.11, el servidor WebSocket integrado reduce una longitud de trama extendida de 64 bits en el campo WSFrame.payloadlen firmado de 32 bits antes de aplicar el tamaño máximo de trama, permitiendo que un cliente remoto no autenticado omita la protección y fuerce una solicitud de asignación de aproximadamente 18 exabytes que termina el proceso. Este problema está solucionado en la versión 1.11.

Information

Published : 2026-07-30 21:17

Updated : 2026-10-23 22:10

NVD link : CVE-2026-55768

Mitre link : CVE-2026-55768

CVE.ORG link : CVE-2026-55768

JSON object : View

Products Affected

No product.

CWE

CWE-681

Incorrect Conversion between Numeric Types

CWE-789

Memory Allocation with Excessive Size Value

{"id": "CVE-2026-55768", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55768", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-31T23:08:54.985832Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "allinurl", "product": "goaccess", "versions": [{"status": "affected", "version": "< 1.11"}]}]}], "published": "2026-07-30T21:17:57.193", "references": [{"url": "https://github.com/allinurl/goaccess/commit/ea74b87254d0adc675c087ff49bddd2d60dc01d5", "source": "security-advisories@github.com"}, {"url": "https://github.com/allinurl/goaccess/security/advisories/GHSA-5gm5-pvh2-wg46", "source": "security-advisories@github.com"}, {"url": "https://github.com/allinurl/goaccess/security/advisories/GHSA-5gm5-pvh2-wg46", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-681"}, {"lang": "en", "value": "CWE-789"}]}], "descriptions": [{"lang": "en", "value": "GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to version 1.11, the built-in WebSocket server narrows a 64-bit extended frame length into the signed 32-bit WSFrame.payloadlen field before enforcing the maximum frame size, allowing an unauthenticated remote client to bypass the guard and force an approximately 18-exabyte allocation request that terminates the process. This issue is fixed in version 1.11."}, {"lang": "es", "value": "GoAccess es un analizador de registros web en tiempo real y visor interactivo que se ejecuta en una terminal en sistemas nix o a trav\u00e9s del navegador. Antes de la versi\u00f3n 1.11, el servidor WebSocket integrado reduce una longitud de trama extendida de 64 bits en el campo WSFrame.payloadlen firmado de 32 bits antes de aplicar el tama\u00f1o m\u00e1ximo de trama, permitiendo que un cliente remoto no autenticado omita la protecci\u00f3n y fuerce una solicitud de asignaci\u00f3n de aproximadamente 18 exabytes que termina el proceso. Este problema est\u00e1 solucionado en la versi\u00f3n 1.11."}], "lastModified": "2026-10-23T22:10:00.160", "sourceIdentifier": "security-advisories@github.com"}