CVE-2026-54715: allinurl goaccess, грешка в паметта

Описание

Оригинално описание

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. In version 1.10.2, parse_browser assumes the matched browser token begins with Opera and moves a trailing version substring to match plus five, allowing a crafted User-Agent in a processed access log to write one to four attacker-influenced bytes beyond the heap allocation and corrupt or crash GoAccess. This issue is fixed in version 1.11.

Засегнати продукти

• allinurl goaccess: >= 1.10.2, < 1.11

Вид слабост

• CWE-122 Препълване на буфера в хийпа
• CWE-787 Out-of-bounds Write

История

Други уязвимости в allinurl goaccess

• 5.3CVE-2026-55777
• 8.7CVE-2026-55768

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-54715
• https://nvd.nist.gov/vuln/detail/CVE-2026-54715
• https://github.com/allinurl/goaccess/security/advisories/GHSA-qcx5-vh2x-35fr
• https://github.com/allinurl/goaccess/commit/81f90d9dafd6956c188dea9f944d24946d3d3351