Executive brief
GoAccess is a real-time web log analyzer used to monitor website traffic and visitor statistics. A vulnerability in how it processes browser information allows an attacker to crash the application or corrupt its memory by sending a specially crafted web request. This occurs when the software analyzes a log file containing a malicious "User-Agent" string, potentially leading to a denial of service for the monitoring tool.
Technical details
A heap-based out-of-bounds write exists in the `parse_browser` function within `src/browsers.c`. The vulnerability is triggered when GoAccess processes a User-Agent string where a short browser keyword (like 'Edg/') precedes the 'Opera' keyword. The code incorrectly assumes the 'Opera' token starts at the beginning of the buffer and performs a `memmove` to a fixed offset (match + 5), resulting in a 1-to-4 byte write beyond the allocated heap buffer. An unauthenticated remote attacker can exploit this by sending a crafted HTTP request to a web server whose logs are subsequently analyzed by GoAccess. This issue is fixed in version 1.11.
Affected products
- allinurl GoAccess 1.10.2
Timeline
- 2026-07-20: advisory: GitHub Security Advisory published
- 2026-07-30: disclosed: CVE-2026-54715 published to NVD
- 2026-07-30: patched: Fix committed in version 1.11