CVE-2026-55777

Received Received - Intake

Heap Buffer Overflow in GoAccess Log Parser

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: GitHub, Inc.

Description

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to 1.11, the parse_ios() function uses an attacker-controlled keyword-to-OS offset as both the source offset and copy length for memmove, allowing a crafted User-Agent in a processed access log to read up to approximately 4 KB beyond the heap allocation and conditionally crash GoAccess. This issue is fixed in version 1.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-55777

Affected Vendors & Products

Vendor	Product	Version / Range
goaccess	goaccess	1.11

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

GoAccess before version 1.11 has a vulnerability in the parse_ios() function where an attacker-controlled keyword-to-OS offset is used as both the source offset and copy length for memmove. This allows a crafted User-Agent in a processed access log to read up to approximately 4 KB beyond the heap allocation and potentially crash GoAccess.

Detection Guidance

To detect this vulnerability, check if your GoAccess version is prior to 1.11. Run 'goaccess --version' to verify the installed version. If it is below 1.11, the system is vulnerable. Additionally, inspect access logs for unusual User-Agent strings that may indicate exploitation attempts.

Impact Analysis

This vulnerability could allow an attacker to read sensitive memory beyond the allocated heap, potentially exposing confidential data or causing the application to crash. It may also enable further exploitation depending on the exposed memory contents.

Compliance Impact

This vulnerability could potentially expose sensitive data if attacker-controlled User-Agent strings in logs trigger memory corruption, leading to unauthorized data access. This may violate GDPR's data protection principles or HIPAA's confidentiality requirements if personal or health data is compromised.

Mitigation Strategies

Upgrade GoAccess to version 1.11 or later to address the vulnerability in the parse_ios() function.

Hi! I’m here to help you understand CVE-2026-55777. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70