CVE-2026-55768

Description

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to version 1.11, the built-in WebSocket server narrows a 64-bit extended frame length into the signed 32-bit WSFrame.payloadlen field before enforcing the maximum frame size, allowing an unauthenticated remote client to bypass the guard and force an approximately 18-exabyte allocation request that terminates the process. This issue is fixed in version 1.11.

Is your site exposed to CVE-2026-55768?

Run a free security scan — no signup, results in seconds.

Weakness Type (CWE)

CWE-681 CWE-681

CWE-789 CWE-789

References

Other References

https://github.com/allinurl/goaccess/commit/ea74b87254d0adc675c087ff49bddd2d60dc01d5 https://github.com/allinurl/goaccess/security/advisories/GHSA-5gm5-pvh2-wg46

Frequently Asked Questions

What is CVE-2026-55768? +

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to version 1.11, the built-in WebSocket server narrows a 64-bit extended frame length into the signed 32-bit WSFrame.payloadlen field before enforcing the maximum frame size, allowing an unauthenticated remote client to bypass the guard and force an approximately 18-exabyte allocation request that terminates the process. This issue is fixed in version 1.11.

How do I check if I'm vulnerable to CVE-2026-55768? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-49093 8.8

Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability

CVE-2024-26162 8.8

Microsoft ODBC Driver Remote Code Execution Vulnerability

CVE-2025-53733 8.4

Incorrect conversion between numeric types in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVE-2026-45258 7.8

dsp_mmap_single() validated the requested mapping by checking the sum of the user-supplied offset and length against the buffer size. This …

CVE-2026-55123 7.8

Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.

CVE-2026-50402 7.8

Incorrect conversion between numeric types in Windows NTFS allows an authorized attacker to elevate privileges locally.