Bug 2509598 (CVE-2026-54715) - CVE-2026-54715 goaccess: GoAccess: Denial of Service due to memory corruption
Summary: CVE-2026-54715 goaccess: GoAccess: Denial of Service due to memory corruption
Keywords:
Status: NEW
Alias: CVE-2026-54715
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2509796 2509798
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-30 21:01 UTC by OSIDB Bzimport
Modified: 2026-07-31 15:02 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-07-30 21:01:55 UTC
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. In version 1.10.2, parse_browser assumes the matched browser token begins with Opera and moves a trailing version substring to match plus five, allowing a crafted User-Agent in a processed access log to write one to four attacker-influenced bytes beyond the heap allocation and corrupt or crash GoAccess. This issue is fixed in version 1.11.


Note You need to log in before you can comment on or make changes to this bug.