CVE-2026-55768

Description

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to version 1.11, the built-in WebSocket server narrows a 64-bit extended frame length into the signed 32-bit WSFrame.payloadlen field before enforcing the maximum frame size, allowing an unauthenticated remote client to bypass the guard and force an approximately 18-exabyte allocation request that terminates the process. This issue is fixed in version 1.11.

Is your site exposed to CVE-2026-55768?

Run a free security scan — no signup, results in seconds.

Weakness Type (CWE)

CWE-681 CWE-681

CWE-789 CWE-789

References

Other References

https://github.com/allinurl/goaccess/commit/ea74b87254d0adc675c087ff49bddd2d60dc01d5 https://github.com/allinurl/goaccess/security/advisories/GHSA-5gm5-pvh2-wg46

Frequently Asked Questions

What is CVE-2026-55768? +

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to version 1.11, the built-in WebSocket server narrows a 64-bit extended frame length into the signed 32-bit WSFrame.payloadlen field before enforcing the maximum frame size, allowing an unauthenticated remote client to bypass the guard and force an approximately 18-exabyte allocation request that terminates the process. This issue is fixed in version 1.11.

How do I check if I'm vulnerable to CVE-2026-55768? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-26162 8.8

Microsoft ODBC Driver Remote Code Execution Vulnerability

CVE-2024-49093 8.8

Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability

CVE-2025-53733 8.4

Incorrect conversion between numeric types in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVE-2025-24059 7.8

Incorrect conversion between numeric types in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

CVE-2026-24192 7.8

NVIDIA Display Driver for Linux contains a vulnerability where an attacker could cause an incorrect conversion between numeric types, leading …

CVE-2026-50402 7.8

Incorrect conversion between numeric types in Windows NTFS allows an authorized attacker to elevate privileges locally.