CyberRota Analysis
AI-GeneratedThe built-in WebSocket server in GoAccess prior to version 1.11 is vulnerable to a denial-of-service attack due to improper handling of frame length, allowing unauthenticated remote clients to trigger excessive memory allocation requests. This can lead to process termination, impacting the availability of the web log analyzer. Organizations using affected versions should prioritize upgrading to version 1.11 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to version 1.11, the built-in WebSocket server narrows a 64-bit extended frame length into the signed 32-bit WSFrame.payloadlen field before enforcing the maximum frame size, allowing an unauthenticated remote client to bypass the guard and force an approximately 18-exabyte allocation request that terminates the process. This issue is fixed in version 1.11.