CVE-2026-55777 in GoAccess
Summary
by MITRE • 07/30/2026
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to 1.11, the parse_ios() function uses an attacker-controlled keyword-to-OS offset as both the source offset and copy length for memmove, allowing a crafted User-Agent in a processed access log to read up to approximately 4 KB beyond the heap allocation and conditionally crash GoAccess. This issue is fixed in version 1.11.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/30/2026
The vulnerability in GoAccess prior to version 1.11 represents a critical heap-based buffer overflow condition that arises from improper input validation within the parse_ios() function. This flaw specifically manifests when processing User-Agent strings in web access logs, where an attacker can craft malicious headers that exploit a vulnerable memory copying operation. The technical implementation involves the use of attacker-controlled data as both the source offset and copy length parameters for the memmove function, creating a scenario where arbitrary heap memory can be read beyond the allocated buffer boundaries.
The operational impact of this vulnerability extends beyond simple information disclosure to potentially enabling remote code execution or system instability through controlled crashes. When an attacker submits a crafted User-Agent string containing malicious offsets, the parse_ios() function executes memmove with these attacker-controlled parameters, allowing memory reads up to approximately 4 kilobytes beyond the heap allocation boundaries. This condition can result in heap corruption that may be exploited to achieve arbitrary code execution or cause application crashes. The vulnerability affects systems running GoAccess versions earlier than 1.11 and specifically targets the terminal-based web log analysis functionality that processes HTTP request headers.
This issue maps directly to CWE-121, Heap-based Buffer Overflow, and represents a classic example of improper input validation leading to memory safety violations. The vulnerability aligns with ATT&CK technique T1059.007 for Command and Scripting Interpreter: Unix Shell and T1203 for Exploitation for Client Execution through the potential for remote exploitation via crafted web log entries. The memory corruption occurs during the parsing of HTTP headers where user-controllable data directly influences memory copy operations without proper bounds checking. Security practitioners should note that this vulnerability demonstrates the critical importance of validating all input data, particularly when such data is used as parameters for memory manipulation functions.
The fix implemented in GoAccess version 1.11 addresses this vulnerability through proper input validation and bounds checking within the parse_ios() function. The updated implementation ensures that attacker-controlled offsets are properly validated against allocated buffer boundaries before being used as parameters for memory operations. This mitigation prevents the use of maliciously crafted User-Agent strings from causing heap corruption or information disclosure. Organizations should immediately upgrade to version 1.11 or later to address this vulnerability, particularly those operating web log analysis systems that process untrusted input data from HTTP requests. The remediation approach follows industry best practices for preventing heap-based buffer overflows through proper parameter validation and memory access control mechanisms.