Approved changes feed: RSS · Atom
cpe:2.3:a:allinurl:goaccess:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Allinurl (d424b14d-0b22-516f-89ff-74ec9fdb095f) |
|---|---|
| Product | Goaccess (53f8e340-0a55-59bb-903f-5d523938cff1) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:deb/debian/goaccess |
purl2cpe | 2026-09-09 08:34:02.226686 |
pkg:deb/ubuntu/goaccess |
purl2cpe | 2026-09-09 08:34:02.226688 |
pkg:github/allinurl/goaccess |
purl2cpe | 2026-09-09 08:34:02.226690 |
pkg:rpm/fedora/goaccess |
purl2cpe | 2026-09-09 08:34:02.226691 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-54715 |
vulnerable | 2026-09-16 04:33:28.325135 |
GoAccess: Heap Out-of-Bounds Write in parse_browser()
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. In version 1.10.2, parse_browser assumes the matched browser token begins with Opera and moves a trailing version substring to match plus five, allowing a crafted User-Agent in a processed access log to write one to four attacker-influenced bytes beyond the heap allocation and corrupt or crash GoAccess. This issue is fixed in version 1.11.
Published: 2026-07-30T20:23:36.554Z
Updated: 2026-07-31T15:30:19.164Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-55777 |
vulnerable | 2026-09-16 04:33:12.832398 |
GoAccess: Out-of-bounds heap read in parse_ios() via crafted User-Agent leads to remote crash/DoS
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to 1.11, the parse_ios() function uses an attacker-controlled keyword-to-OS offset as both the source offset and copy length for memmove, allowing a crafted User-Agent in a processed access log to read up to approximately 4 KB beyond the heap allocation and conditionally crash GoAccess. This issue is fixed in version 1.11.
Published: 2026-07-30T20:37:40.575Z
Updated: 2026-07-31T11:24:05.795Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-55768 |
vulnerable | 2026-09-16 04:33:12.630909 |
GoAccess WebSocket Server: Signed 32 bit truncation of the 64 bit frame length causes a remote pre-authentication denial of service
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to version 1.11, the built-in WebSocket server narrows a 64-bit extended frame length into the signed 32-bit WSFrame.payloadlen field before enforcing the maximum frame size, allowing an unauthenticated remote client to bypass the guard and force an approximately 18-exabyte allocation request that terminates the process. This issue is fixed in version 1.11.
Published: 2026-07-30T20:34:32.833Z
Updated: 2026-07-31T23:10:06.368Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.