Hi Antonio, On Mon, Aug 17, 2026 at 06:55:54PM -0300, Antonio Terceiro wrote: > On Fri, Jul 31, 2026 at 02:31:52PM +0200, Salvatore Bonaccorso wrote: > > Source: goaccess > > Version: 1:1.10.1-1 > > Severity: important > > Tags: security upstream > > X-Debbugs-Cc: [email protected], Debian Security Team > > <[email protected]> > > > > Hi, > > > > The following vulnerabilities were published for goaccess. > > > > CVE-2026-54715[0]: > > | GoAccess is a real-time web log analyzer and interactive viewer that > > | runs in a terminal in *nix systems or through the browser. In > > | version 1.10.2, parse_browser assumes the matched browser token > > | begins with Opera and moves a trailing version substring to match > > | plus five, allowing a crafted User-Agent in a processed access log > > | to write one to four attacker-influenced bytes beyond the heap > > | allocation and corrupt or crash GoAccess. This issue is fixed in > > | version 1.11. > > > > > > CVE-2026-55768[1]: > > | GoAccess is a real-time web log analyzer and interactive viewer that > > | runs in a terminal in *nix systems or through the browser. Prior to > > | version 1.11, the built-in WebSocket server narrows a 64-bit > > | extended frame length into the signed 32-bit WSFrame.payloadlen > > | field before enforcing the maximum frame size, allowing an > > | unauthenticated remote client to bypass the guard and force an > > | approximately 18-exabyte allocation request that terminates the > > | process. This issue is fixed in version 1.11. > > > > > > CVE-2026-55777[2]: > > | GoAccess is a real-time web log analyzer and interactive viewer that > > | runs in a terminal in *nix systems or through the browser. Prior to > > | 1.11, the parse_ios() function uses an attacker-controlled keyword- > > | to-OS offset as both the source offset and copy length for memmove, > > | allowing a crafted User-Agent in a processed access log to read up > > | to approximately 4 KB beyond the heap allocation and conditionally > > | crash GoAccess. This issue is fixed in version 1.11. > > > > > > If you fix the vulnerabilities please also make sure to include the > > CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. > > I just uploaded a new upstream release that includes the fixes for these > to unstable.
Thank you very much, updating the metadata on our end. > I also have a trixie branch where I cherry picked the individual fixes. > I'm attaching the full diff and the individual patches here, LMK what > you think. Are you releasing a DSA for those, or should I go for a > stable update? I think a point release update would be enough here, we did already mark the issues no-dsa in the tracker. Thanks for your work! Regards, Salvatore
