CVE-2026-55768

Katalog CVE

CVSS 8.7 · High EPSS 0,47%

Kerentanan Incorrect Conversion between Numeric Types. Skor CVSS 4.0 8.7 (High) menurut github.com.

Deskripsi (NVD)

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to version 1.11, the built-in WebSocket server narrows a 64-bit extended frame length into the signed 32-bit WSFrame.payloadlen field before enforcing the maximum frame size, allowing an unauthenticated remote client to bypass the guard and force an approximately 18-exabyte allocation request that terminates the process. This issue is fixed in version 1.11.

Rincian

Terbit di NVD

30 Juli 2026

Terakhir diubah

8 September 2026

Status NVD

Deferred

CVSS 4.0

8.7 (High), sumber github.com
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-681: Incorrect Conversion between Numeric Types
CWE-789: Memory Allocation with Excessive Size Value

EPSS (30 hari)

0,47% peluang dieksploitasi; lebih tinggi dari 39,1% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/allinurl/goaccess/commit/ea74b87254d0adc675c087ff49bddd2d60dc01d5
• https://github.com/allinurl/goaccess/security/advisories/GHSA-5gm5-pvh2-wg46