# CVE-2026-55768: GoAccess integer truncation denial of service in WebSocket server

Source: https://junglewise.ai/threats/cve-2026-55768-goaccess-integer-truncation-denial-of-service-in-websocket-server  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-30. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-55768 · Severity: info · CVSS 8.7 · Published 2026-07-30

GoAccess is a real-time web log analyzer that provides a live dashboard via a built-in WebSocket server. A vulnerability in this server allows an unauthenticated remote attacker to crash the application by sending a specially crafted data packet. This results in a denial of service, preventing all users from accessing the live dashboard and requiring a manual restart of the service.

Technologies: [Allinurl GoAccess](https://junglewise.ai/threats/technologies/goaccess). Vendors: [Allinurl](https://junglewise.ai/threats/vendors/allinurl).

## Quick answers

**Is CVE-2026-55768 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55768 being exploited in the wild.

**How severe is CVE-2026-55768?** Informational severity, with a CVSS score of 8.7, published 30 July 2026.

**Which products and versions are affected?** Allinurl GoAccess < 1.11.

**Is there a fix for CVE-2026-55768?** A patch was published on 2026-07-30: Fix committed in version 1.11 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55768 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-55768?** Check whether you run Allinurl GoAccess at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A numeric truncation vulnerability (CWE-681) exists in the GoAccess WebSocket server (enabled via --real-time-html). When processing a WebSocket frame, the server stores a 64-bit extended payload length into a signed 32-bit integer field (WSFrame.payloadlen). By sending a frame with bit 31 set (e.g., 0x80000000), the value is interpreted as a negative integer, bypassing the maximum frame size check. This negative value is subsequently sign-extended to a massive 64-bit value (approximately 18 exabytes) during a call to xcalloc. The resulting allocation failure triggers a fatal error handler that calls exit(), terminating the process. This can be exploited pre-authentication by any client capable of completing a WebSocket handshake. The issue is fixed in version 1.11.

## Affected products

- allinurl GoAccess < 1.11

## Timeline

- 2026-07-20: advisory: GitHub Security Advisory published
- 2026-07-30: disclosed: CVE published to NVD
- 2026-07-30: patched: Fix committed in version 1.11

## References

- [https://github.com/allinurl/goaccess/commit/ea74b87254d0adc675c087ff49bddd2d60dc01d5](https://github.com/allinurl/goaccess/commit/ea74b87254d0adc675c087ff49bddd2d60dc01d5)
- [https://github.com/allinurl/goaccess/security/advisories/GHSA-5gm5-pvh2-wg46](https://github.com/allinurl/goaccess/security/advisories/GHSA-5gm5-pvh2-wg46)

## Related threats

- [GoAccess out-of-bounds read in parse_ios function](https://junglewise.ai/threats/cve-2026-55777-goaccess-out-of-bounds-read-in-parse-ios-function)
- [GoAccess heap-based buffer overflow in parse_browser](https://junglewise.ai/threats/cve-2026-54715-goaccess-heap-based-buffer-overflow-in-parse-browser)