EUVD-2026-51300Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Malicious User-Agent arrives over the network (AV:N) unauthenticated (PR:N), but an operator must run GoAccess on the poisoned log (UI:R); bounded OOB write gives I:L and crash-driven A:H with no confidentiality impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. In version 1.10.2, parse_browser assumes the matched browser token begins with Opera and moves a trailing version substring to match plus five, allowing a crafted User-Agent in a processed access log to write one to four attacker-influenced bytes beyond the heap allocation and corrupt or crash GoAccess. This issue is fixed in version 1.11.
AnalysisAI
Heap buffer overflow in GoAccess 1.10.2's parse_browser() routine lets a remote attacker corrupt or crash the analyzer by planting a crafted User-Agent string in a web server access log that an operator later processes. Because the code assumes any Opera-matched token starts with the literal 'Opera' and relocates the trailing version substring to a fixed match+5 offset, a specially formed UA drives a memmove that writes one to four attacker-influenced bytes past a heap allocation. There is no public exploit identified at time of analysis, and the flaw is fixed in version 1.11.
Technical ContextAI
GoAccess is a C-based real-time web log analyzer (CPE cpe:2.3:a:allinurl:goaccess) that parses access-log User-Agent fields to classify browsers. The bug is a CWE-122 heap-based buffer overflow in src/browsers.c: the original parse_browser() logic executed if (strstr(match, "Opera") && (slh = strrchr(match, '/')) && match < slh) memmove(match + 5, slh, strlen(slh) + 1). It hard-coded the destination as match+5 on the incorrect assumption that the matched token begins with the 5-character string 'Opera'. When 'Opera' appears later in the token (not at offset 0), match+5 points before the true 'Opera'+5 boundary, so relocating the trailing '/version' slash-substring writes past the allocated buffer. The upstream commit 81f90d9 corrects this by capturing the actual match position (op = strstr(match, "Opera")), writing to op+5, and adding the bounds guard op + 5 <= slh.
RemediationAI
Vendor-released patch: upgrade to GoAccess 1.11, which fixes the parse_browser() overflow via commit https://github.com/allinurl/goaccess/commit/81f90d9dafd6956c188dea9f944d24946d3d3351 (see advisory https://github.com/allinurl/goaccess/security/advisories/GHSA-qcx5-vh2x-35fr). If you cannot upgrade immediately, avoid running the vulnerable 1.10.2 binary against untrusted or internet-facing access logs; where feasible, pre-sanitize or strip anomalous User-Agent strings before feeding logs to GoAccess, or run the parser in a sandboxed/low-privilege container so a crash or heap corruption cannot affect other services. The trade-off is that log pre-filtering can drop legitimately unusual User-Agent data and reduce reporting fidelity, and sandboxing adds operational overhead, so patching to 1.11 remains the definitive fix.
Denial of service in GoAccess before version 1.11 allows an unauthenticated remote client to crash the built-in real-tim
Out-of-bounds heap read in GoAccess prior to version 1.11 allows a remote unauthenticated attacker to read approximately
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today