GoAccess contains an internal WebSocket server that parses 64‑bit frame lengths but stores them in a signed 32‑bit field before the maximum‑size guard is applied. The truncation allows a frame that appears to be within the allowed limits to actually be larger, causing the server to attempt to allocate an astronomically large amount of memory – on the order of 18 exabytes – and crash. The flaw is a classic type error (CWE‑681) coupled with insufficient input validation leading to a memory allocation error (CWE‑789). The primary impact is a denial of service that can be triggered before any authentication occurs.

All versions of GoAccess released before 1.11 on *nix systems or accessed through the browser are vulnerable. The issue resides in the built‑in WebSocket server component, so any deployment exposing this server to external traffic is at risk. Users running GoAccess in a terminal or embedding it in a web interface without upgrading fall into this category.

The CVSS score of 8.7 indicates high severity. The EPSS score is listed as less than 1 %, implying that the likelihood of exploitation in the wild is very low but not zero. The vulnerability is not included in CISA KEV. The likely attack vector, inferred from the nature of the flaw, is an unauthenticated remote client establishing a WebSocket connection to the GoAccess server and sending a specially crafted frame that bypasses length checks, causing the server to allocate an excessive buffer and terminate. No credentials are required, so the potential for abuse exists in any exposed environment.