Your message dated Sat, 05 Sep 2026 17:32:06 +0000
with message-id <[email protected]>
and subject line Bug#1143181: fixed in goaccess 1:1.9.3-1+deb13u1
has caused the Debian Bug report #1143181,
regarding goaccess: CVE-2026-54715 CVE-2026-55768 CVE-2026-55777
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1143181: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1143181
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: goaccess
Version: 1:1.10.1-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerabilities were published for goaccess.
CVE-2026-54715[0]:
| GoAccess is a real-time web log analyzer and interactive viewer that
| runs in a terminal in *nix systems or through the browser. In
| version 1.10.2, parse_browser assumes the matched browser token
| begins with Opera and moves a trailing version substring to match
| plus five, allowing a crafted User-Agent in a processed access log
| to write one to four attacker-influenced bytes beyond the heap
| allocation and corrupt or crash GoAccess. This issue is fixed in
| version 1.11.
CVE-2026-55768[1]:
| GoAccess is a real-time web log analyzer and interactive viewer that
| runs in a terminal in *nix systems or through the browser. Prior to
| version 1.11, the built-in WebSocket server narrows a 64-bit
| extended frame length into the signed 32-bit WSFrame.payloadlen
| field before enforcing the maximum frame size, allowing an
| unauthenticated remote client to bypass the guard and force an
| approximately 18-exabyte allocation request that terminates the
| process. This issue is fixed in version 1.11.
CVE-2026-55777[2]:
| GoAccess is a real-time web log analyzer and interactive viewer that
| runs in a terminal in *nix systems or through the browser. Prior to
| 1.11, the parse_ios() function uses an attacker-controlled keyword-
| to-OS offset as both the source offset and copy length for memmove,
| allowing a crafted User-Agent in a processed access log to read up
| to approximately 4 KB beyond the heap allocation and conditionally
| crash GoAccess. This issue is fixed in version 1.11.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-54715
https://www.cve.org/CVERecord?id=CVE-2026-54715
[1] https://security-tracker.debian.org/tracker/CVE-2026-55768
https://www.cve.org/CVERecord?id=CVE-2026-55768
[2] https://security-tracker.debian.org/tracker/CVE-2026-55777
https://www.cve.org/CVERecord?id=CVE-2026-55777
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: goaccess
Source-Version: 1:1.9.3-1+deb13u1
Done: Antonio Terceiro <[email protected]>
We believe that the bug you reported is fixed in the latest version of
goaccess, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Antonio Terceiro <[email protected]> (supplier of updated goaccess package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 17 Aug 2026 18:49:23 -0300
Source: goaccess
Architecture: source
Version: 1:1.9.3-1+deb13u1
Distribution: trixie
Urgency: high
Maintainer: Antonio Terceiro <[email protected]>
Changed-By: Antonio Terceiro <[email protected]>
Closes: 1143181
Changes:
goaccess (1:1.9.3-1+deb13u1) trixie; urgency=high
.
* Apply security updates (Closes: #1143181)
Includes fixes for the following vulnerabilities:
- CVE-2026-54715: Heap Out-of-Bounds Write in GoAccess `parse_browser()`
- CVE-2026-55768: GoAccess WebSocket server: signed 32 bit truncation of
the 64 bit frame length causes a remote pre authentication denial of
service
- CVE-2026-55777: Out-of-bounds heap read in parse_ios() via crafted
User-Agent (opesys.c:323) lead to remote crash/DoS
* debian/salsa-ci.yml: disable uscan test for this branch
Checksums-Sha1:
4b2fb2367e02e4c08e7afe4e0f5d2836c56790ca 2023 goaccess_1.9.3-1+deb13u1.dsc
f35aa15e7f9b7642168868d34684532d2929c808 156964
goaccess_1.9.3-1+deb13u1.debian.tar.xz
abb33d319453831068c77e71e30061a4888b83f2 6574
goaccess_1.9.3-1+deb13u1_source.buildinfo
Checksums-Sha256:
9bb9db61ebc19f06eb89b2cc4f60a23427a4bbd0174896f9461767a99426ab87 2023
goaccess_1.9.3-1+deb13u1.dsc
2f477a3b3a06efae29680e649ae68c76db479eeccbd22a05f8c895d356e28710 156964
goaccess_1.9.3-1+deb13u1.debian.tar.xz
866b3567aafd691e49eb4d32bc617f1b01f5f50c688a9c9394e1c2097df9363d 6574
goaccess_1.9.3-1+deb13u1_source.buildinfo
Files:
c1c81ee4ab4e0ac262c715482f6e20ae 2023 utils optional
goaccess_1.9.3-1+deb13u1.dsc
ebed69f90b620dffb87d50e00bf6b910 156964 utils optional
goaccess_1.9.3-1+deb13u1.debian.tar.xz
01430c91e8bbd9cb16213f5f4f5f7f6b 6574 utils optional
goaccess_1.9.3-1+deb13u1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEst7mYDbECCn80PEM/A2xu81GC94FAmqcKuMACgkQ/A2xu81G
C94P2g/+J9IKaLmtoMGydXihczwUpMjkdMWYVI3adfHfbGVrqg6yp5NApWTUHIaI
NMpVdIy6uIoHJnW5y5ChS47kcchmJpLwee9iAtkrBZLI2yuEP8UiuIVUfjU1ZA7/
GsXyk4VpyoyleZtldzgiTM/n7HZZmnvrdLxMa5DFOFSX0Z76xc9HDXiBoA+SEbW9
lkc3H+kViaKK8TdkONHix6dVU/0Z5zKRgv6lizj8Me3DzS8QjTaoW1fmTWG7wtTi
Sj8zWECU2wCWs+7Aa1ei96Ex38Pxff1X9/+vzlwL3tk4V5c199FX3mL5OTUm2MXx
QbEGgPcsbF8lCdNTyAhNjWEIeQXX1iFN6YcKI3li3nxv9gZmYDASUXBMwhOTQ70C
rRdt7ulk9zr6HNhQNju+xIoMXpfzIJpf087UxtOYEIpge0Dsqwmz1kx47n0xUxDb
uxHqUAXZwuYu9hwIsGF/39sgfkZxei4V2MgKzY5iL69K0/aXniY7r1aFvXJjqL7F
5Kcxtj5kPHQPEb3ybdjcztaGcGL8bWx1wOcg7KyLY0iavQc9YvRG1Gn6A+6Ap3u4
Rt+lHWNMsi3cyLIlF9OIqXZ0dfFWyr/MRp8+BQEJJoArx1IXbTS2x0NOTiTOwyqq
CVSr1YBg/DD5A/n++d6va/CuHEr671mJ37T2zY4VK7eAVA8VVQ0=
=K1Vh
-----END PGP SIGNATURE-----
pgpmSY1_3zqzI.pgp
Description: PGP signature
--- End Message ---
