CVE-2026-55768 in goaccess
Summary
by MITRE • 07/30/2026
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to version 1.11, the built-in WebSocket server narrows a 64-bit extended frame length into the signed 32-bit WSFrame.payloadlen field before enforcing the maximum frame size, allowing an unauthenticated remote client to bypass the guard and force an approximately 18-exabyte allocation request that terminates the process. This issue is fixed in version 1.11.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/30/2026
The GoAccess web log analyzer presents a critical buffer overflow vulnerability stemming from improper handling of WebSocket frame length values within its built-in WebSocket server implementation. This flaw exists in versions prior to 1.11 and specifically affects the WSFrame.payloadlen field which is defined as a signed 32-bit integer rather than the 64-bit extended frame length that is being processed. The vulnerability arises from a type conversion error where a 64-bit value representing the extended frame length is cast down to a 32-bit signed integer, resulting in a significant data loss and potential overflow condition.
The technical execution of this vulnerability allows an unauthenticated remote attacker to manipulate WebSocket frame headers and submit maliciously constructed frame lengths that exceed the normal 32-bit signed integer limits. When the system processes these extended frame values, it performs an implicit conversion from 64-bit unsigned to 32-bit signed integer format, which causes the upper bits of the original value to be truncated or misinterpreted. This truncation results in a massive payload length value that far exceeds normal WebSocket frame size limitations and can cause the application to attempt allocating approximately 18 exabytes of memory.
The operational impact of this vulnerability is severe as it leads to immediate process termination through memory allocation failure rather than allowing for a more subtle exploitation vector. The system crashes when attempting to fulfill the enormous allocation request, effectively causing a denial of service condition that impacts all users of the GoAccess web log analysis tool. The vulnerability affects both terminal and browser-based usage modes since the WebSocket server component is utilized regardless of the interface being accessed.
This vulnerability aligns with CWE-190, Integer Overflow or Wraparound, and specifically demonstrates improper handling of integer conversions between different bit widths. The issue also maps to ATT&CK technique T1499.004, Network Denial of Service, as it enables remote attackers to cause system unavailability through crafted WebSocket frames. The flaw represents a classic case of insufficient input validation combined with unsafe type conversion practices that are common in network protocol implementations where data integrity assumptions are violated.
Mitigation strategies include upgrading to GoAccess version 1.11 or later where the frame length handling has been corrected to properly validate and handle extended frame lengths without truncation errors. Administrators should also implement network-level filtering to restrict WebSocket connections where possible, and monitor for unusual WebSocket frame size patterns that might indicate exploitation attempts. Additionally, implementing proper input validation on all WebSocket frame headers and ensuring appropriate bounds checking before any memory allocation operations can prevent similar issues in other applications utilizing similar protocols.