GoAccess performs an out‑of‑bounds heap read in its parse_ios() routine when processing a User‑Agent string. An attacker can supply a crafted User‑Agent in a log entry that causes GoAccess to read about 4 KB beyond the allocated memory, resulting in an immediate crash. The failure leads to a denial of service for the log analysis service, affecting confidentiality only at the service level, not to the underlying system. The weakness is identified as CWE‑125.

All users running GoAccess prior to version 1.11 are affected. The vulnerability applies to the GoAccess project maintained by allinurl; any instance of this software ingesting HTTP logs that include a User‑Agent field is potentially vulnerable.

With a CVSS score of 5.3, the vulnerability is of moderate severity. The EPSS score is 0.00263, indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector involves generating a log entry with a crafted User‑Agent—this can be achieved remotely by sending HTTP requests whose headers are recorded in the log. Once the vulnerable parse_ios() function processes the log, the process will terminate, causing a temporary denial of service until restarted.