A critical vulnerability in GoAccess allows remote, unauthenticated attackers to cause a denial of service via memory allocation with excessive size values.

The software is susceptible to memory allocation errors (CWE-789) and incorrect numeric type conversions (CWE-681). These flaws allow an unauthenticated remote attacker to trigger excessive memory consumption, leading to a crash or service failure.

With a CVSS score of 8.7, this vulnerability poses a significant risk to the availability of log analysis services. An attacker can remotely disrupt the ability to monitor web traffic, potentially hiding malicious activity or causing systemic monitoring outages that hinder incident response efforts.

Immediate Action: Upgrade to GoAccess version 1.11 or later to resolve the underlying memory management and conversion issues.

Proactive Monitoring: Monitor system memory usage and service process stability for unexpected restarts or spikes in resource consumption.

Compensating Controls: Use resource limits (ulimit) or container-based resource constraints to limit the memory impact if an exploit is attempted.

Public Exploit Available: False

Operators of GoAccess should upgrade to version 1.11 immediately to mitigate the risk of remote denial-of-service attacks. The ease of triggering this condition makes it a priority for environments where GoAccess is exposed to network traffic.