CVE-2026-55768

Received Received - Intake

GoAccess WebSocket Server Memory Allocation Bypass

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: GitHub, Inc.

Description

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to version 1.11, the built-in WebSocket server narrows a 64-bit extended frame length into the signed 32-bit WSFrame.payloadlen field before enforcing the maximum frame size, allowing an unauthenticated remote client to bypass the guard and force an approximately 18-exabyte allocation request that terminates the process. This issue is fixed in version 1.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-55768

Affected Vendors & Products

Vendor	Product	Version / Range
goaccess	goaccess	to 1.11 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-681	When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
CWE-789	The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

Executive Summary

GoAccess before version 1.11 has a vulnerability in its WebSocket server where a 64-bit frame length is incorrectly narrowed to a 32-bit signed integer before checking the maximum frame size. This allows an unauthenticated remote attacker to send a specially crafted request that forces an allocation of approximately 18 exabytes of memory, causing the process to terminate.

Detection Guidance

Detecting this vulnerability requires checking the GoAccess version in use. Run 'goaccess --version' to verify if the installed version is below 1.11. If it is, the system is vulnerable. Additionally, monitor network traffic for unusually large WebSocket frame requests targeting GoAccess instances.

Impact Analysis

This vulnerability could allow an attacker to crash the GoAccess server by sending a malicious WebSocket request, leading to a denial of service. The server would become unavailable until restarted, disrupting log analysis and monitoring capabilities.

Compliance Impact

The vulnerability allows unauthenticated remote clients to force an approximately 18-exabyte allocation request, which could lead to denial-of-service conditions. This may impact compliance by disrupting availability of systems processing personal or sensitive data, potentially violating GDPR's availability principle or HIPAA's access controls and integrity requirements.

Mitigation Strategies

Immediately upgrade GoAccess to version 1.11 or later. If upgrading is not possible, disable the WebSocket server feature in GoAccess or restrict network access to the GoAccess service to prevent unauthenticated remote clients from exploiting the vulnerability.

Hi! I’m here to help you understand CVE-2026-55768. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70