Goaccess
Monthly
Out-of-bounds heap read in GoAccess prior to version 1.11 allows a remote unauthenticated attacker to read approximately 4 KB beyond a heap allocation and conditionally crash the analyzer by embedding a crafted User-Agent string into any web server access log that GoAccess subsequently processes. The defect resides in the parse_ios() function (src/opesys.c), where an attacker-controlled keyword-to-OS offset value is incorrectly passed as both the source pointer offset and the copy length to memmove(), violating the intended semantics and enabling the out-of-bounds read. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a vendor-confirmed fix is available in version 1.11.
Denial of service in GoAccess before version 1.11 allows an unauthenticated remote client to crash the built-in real-time WebSocket server by sending a crafted frame whose 64-bit extended payload length is truncated into a signed 32-bit field before the maximum-frame-size guard runs. The truncation lets the length check be bypassed, triggering an approximately 18-exabyte memory allocation request that fails and terminates the process. No public exploit identified at time of analysis, but the upstream fix commit and GitHub Security Advisory GHSA-5gm5-pvh2-wg46 confirm the root cause and remediation.
Heap buffer overflow in GoAccess 1.10.2's parse_browser() routine lets a remote attacker corrupt or crash the analyzer by planting a crafted User-Agent string in a web server access log that an operator later processes. Because the code assumes any Opera-matched token starts with the literal 'Opera' and relocates the trailing version substring to a fixed match+5 offset, a specially formed UA drives a memmove that writes one to four attacker-influenced bytes past a heap allocation. There is no public exploit identified at time of analysis, and the flaw is fixed in version 1.11.
Out-of-bounds heap read in GoAccess prior to version 1.11 allows a remote unauthenticated attacker to read approximately 4 KB beyond a heap allocation and conditionally crash the analyzer by embedding a crafted User-Agent string into any web server access log that GoAccess subsequently processes. The defect resides in the parse_ios() function (src/opesys.c), where an attacker-controlled keyword-to-OS offset value is incorrectly passed as both the source pointer offset and the copy length to memmove(), violating the intended semantics and enabling the out-of-bounds read. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a vendor-confirmed fix is available in version 1.11.
Denial of service in GoAccess before version 1.11 allows an unauthenticated remote client to crash the built-in real-time WebSocket server by sending a crafted frame whose 64-bit extended payload length is truncated into a signed 32-bit field before the maximum-frame-size guard runs. The truncation lets the length check be bypassed, triggering an approximately 18-exabyte memory allocation request that fails and terminates the process. No public exploit identified at time of analysis, but the upstream fix commit and GitHub Security Advisory GHSA-5gm5-pvh2-wg46 confirm the root cause and remediation.
Heap buffer overflow in GoAccess 1.10.2's parse_browser() routine lets a remote attacker corrupt or crash the analyzer by planting a crafted User-Agent string in a web server access log that an operator later processes. Because the code assumes any Opera-matched token starts with the literal 'Opera' and relocates the trailing version substring to a fixed match+5 offset, a specially formed UA drives a memmove that writes one to four attacker-influenced bytes past a heap allocation. There is no public exploit identified at time of analysis, and the flaw is fixed in version 1.11.