CVE-2026-55768

GoAccess WebSocket Server: Signed 32 bit truncation of the 64 bit frame length causes a remote pre-authentication denial of service

8.7 HighFix available

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to version 1.11, the built-in WebSocket server narrows a 64-bit extended frame length into the signed 32-bit WSFrame.payloadlen field before enforcing the maximum frame size, allowing an unauthenticated remote client to bypass the guard and force an approximately 18-exabyte allocation request that terminates the process. This issue is fixed in version 1.11.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.47%Up 0.2 points since Jul 31, 2026

What each source reports

CVE List Score used 8.7

GoAccess WebSocket Server: Signed 32 bit truncation of the 64 bit frame length causes a remote pre-authentication denial of service

Record: CVE-2026-55768
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-789, CWE-681
Updated: 2026-11-02

EUVDEUVD-2026-51305 8.7

Record: EUVD-2026-51305
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-02

NVD 8.7

Record: CVE-2026-55768
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-681, CWE-789
Updated: 2026-11-02

OSV 8.7

GoAccess WebSocket Server: Signed 32 bit truncation of the 64 bit frame length causes a remote pre-authentication denial of service

Record: CVE-2026-55768
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-681, CWE-789
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-55768 8.7

Record: DEBIAN-CVE-2026-55768
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated: 2026-11-02

OSVOESA-2026-3263 8.7

goaccess security update

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems. It provides fast and valuable HTTP statistics for system administrators that require a visual server report on the fly.

Security Fix(es):

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. In version 1.10.2, parse_browser assumes the matched browser token begins with Opera and moves a trailing version substring to match plus five, allowing a crafted User-Agent in a processed access log to write one to four attacker-influenced bytes beyond the heap allocation and corrupt or crash GoAccess. This issue is fixed in version 1.11.(CVE-2026-54715)

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to 1.11, the parse_ios() function uses an attacker-controlled keyword-to-OS offset as both the source offset and copy length for memmove, allowing a crafted User-Agent in a processed access log to read up to approximately 4 KB beyond the heap allocation and conditionally crash GoAccess. This issue is fixed in version 1.11.(CVE-2026-55777)

Record: OESA-2026-3263
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-55768 8.7

Record: UBUNTU-CVE-2026-55768
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-02

Affected products

allinurl goaccess

Affected packages

Affected packages
Package	Affected	Fixed
`goaccess` Debian:12	All versions, plus listed versions 1:1.10.1-11:1.11-11:1.7-11:1.8.1-11:1.9.1-11:1.9.3-11:1.9.4-1	None known
`goaccess` Debian:13	before 1:1.9.3-1+deb13u1, plus listed versions 1:1.9.3-1	1:1.9.3-1+deb13u1
`goaccess` Debian:14	before 1:1.11-1, plus listed versions 1:1.10.1-11:1.9.3-11:1.9.4-1	1:1.11-1
`goaccess` openEuler:20.03-LTS-SP4	before 1.4.6-3.oe2003sp4	1.4.6-3.oe2003sp4
`goaccess` openEuler:22.03-LTS-SP4	before 1.4.6-3.oe2203sp4	1.4.6-3.oe2203sp4
`goaccess` openEuler:24.03-LTS-SP1	before 1.7.2-2.oe2403sp1	1.7.2-2.oe2403sp1
`goaccess` openEuler:24.03-LTS-SP3	before 1.7.2-2.oe2403sp3	1.7.2-2.oe2403sp3
`goaccess` openEuler:24.03-LTS-SP4	before 1.7.2-2.oe2403sp4	1.7.2-2.oe2403sp4
`goaccess` Ubuntu:16.04:LTS	All versions, plus listed versions 1:0.8.3-11:0.9.4-11:0.9.4-1build1	None known
`goaccess` Ubuntu:18.04:LTS	All versions, plus listed versions 1:1.2-3	None known

Show 5 moreShow less

Affected packages
Package	Affected	Fixed
`goaccess` Ubuntu:20.04:LTS	All versions, plus listed versions 1:1.2-41:1.3-1	None known
`goaccess` Ubuntu:22.04:LTS	All versions, plus listed versions 1:1.4-11:1.5.1-11:1.5.1-1build11:1.5.5-1	None known
`goaccess` Ubuntu:24.04:LTS	All versions, plus listed versions 1:1.7-11:1.8.1-11:1.8.1-1build11:1.8.1-1build21:1.8.1-1build3	None known
`goaccess` Ubuntu:26.10	All versions, plus listed versions 1:1.9.4-11:1.10.1-11:1.11-1	None known
`goaccess` Ubuntu:26.04:LTS	All versions, plus listed versions 1:1.9.3-11:1.9.3-1build11:1.9.4-1	None known

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-55768 is a high vulnerability (CVSS 8.7) in Allinurl Goaccess, published July 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 40th percentile. Fixed in goaccess 1:1.9.3-1+deb13u1.

References

Show 4 moreShow less