CVE-2026-55768

The record

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to version 1.11, the built-in WebSocket server narrows a 64-bit extended frame length into the signed 32-bit WSFrame.payloadlen field before enforcing the maximum frame size, allowing an unauthenticated remote client to bypass the guard and force an approximately 18-exabyte allocation request that terminates the process. This issue is fixed in version 1.11.

Affected packages

Related vulnerabilities

• CVE-2026-119340 Tesseract is an open source OCR engine. CWE-681
• CVE-2026-118769 Botan is a C++ cryptography library. CWE-681
• CVE-2026-114654 A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver… CWE-681
• CVE-2026-114118 Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in… CWE-681
• CVE-2026-12670 IBM MQ could allow an authenticated attacker to cause a denial of service through a… CWE-681
• CVE-2026-106432 The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value… CWE-681
• CVE-2026-98095 In the Linux kernel, the following vulnerability has been resolved: af_packet: Don't cast… CWE-681
• CVE-2026-98049 In the Linux kernel, the following vulnerability has been resolved: bpf: zero extend the… CWE-681