{"id":"CVE-2026-54715","summary":"GoAccess: Heap Out-of-Bounds Write in parse_browser()","details":"GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. In version 1.10.2, parse_browser assumes the matched browser token begins with Opera and moves a trailing version substring to match plus five, allowing a crafted User-Agent in a processed access log to write one to four attacker-influenced bytes beyond the heap allocation and corrupt or crash GoAccess. This issue is fixed in version 1.11.","aliases":["GHSA-qcx5-vh2x-35fr"],"modified":"2026-09-10T08:13:50.288679Z","published":"2026-07-30T20:23:36.554Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-122","CWE-787"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54715.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54715.json"},{"type":"ADVISORY","url":"https://github.com/allinurl/goaccess/security/advisories/GHSA-qcx5-vh2x-35fr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54715"},{"type":"FIX","url":"https://github.com/allinurl/goaccess/commit/81f90d9dafd6956c188dea9f944d24946d3d3351"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/allinurl/goaccess","events":[{"introduced":"637824bbcd8e83327b7e4e881eab5c52ea9e20c5"},{"fixed":"81f90d9dafd6956c188dea9f944d24946d3d3351"}],"database_specific":{"extracted_events":[{"introduced":"1.10.2"},{"fixed":"1.11"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v1.10.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54715.json","vanir_signatures_modified":"2026-09-10T08:13:50Z","vanir_signatures":[{"source":"https://github.com/allinurl/goaccess/commit/81f90d9dafd6956c188dea9f944d24946d3d3351","target":{"file":"src/browsers.c"},"deprecated":false,"digest":{"line_hashes":["71214995160074076757073623071368671534","39014293296256954895130569858648669414","328112626287818340513276652619749867053","11623068854616747256384308249150930687","330512927121772150424162931596511842993","141951274977303881606147808802070688438","90181478742267660384140873963498199649","309853410928840274065396629218365420876","220955779842820798787757301385808611884"],"threshold":0.9},"id":"CVE-2026-54715-0406b06e","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"125742440747565909876414940426977234743","length":1087},"id":"CVE-2026-54715-2ca9c897","signature_type":"Function","signature_version":"v1","source":"https://github.com/allinurl/goaccess/commit/81f90d9dafd6956c188dea9f944d24946d3d3351","target":{"file":"src/browsers.c","function":"parse_browser"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N"}]}