CVE-2026-55768: allinurl goaccess, отказ на услуга

Описание

Оригинално описание

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to version 1.11, the built-in WebSocket server narrows a 64-bit extended frame length into the signed 32-bit WSFrame.payloadlen field before enforcing the maximum frame size, allowing an unauthenticated remote client to bypass the guard and force an approximately 18-exabyte allocation request that terminates the process. This issue is fixed in version 1.11.

Засегнати продукти

• allinurl goaccess: < 1.11

Вид слабост

• CWE-789 Memory Allocation with Excessive Size Value
• CWE-681 Incorrect Conversion between Numeric Types

История

Други уязвимости в allinurl goaccess

• 5.3CVE-2026-55777
• 7.1CVE-2026-54715

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-55768
• https://nvd.nist.gov/vuln/detail/CVE-2026-55768
• https://github.com/allinurl/goaccess/security/advisories/GHSA-5gm5-pvh2-wg46
• https://github.com/allinurl/goaccess/commit/ea74b87254d0adc675c087ff49bddd2d60dc01d5