GoAhead 6.1.1 fixes three TLS flaws in embedded web servers
A critical OpenSSL-backend bug can accept revoked client certificates; the other flaws weaken DHE or chain checks.
74
Vulnerability1 · 1 read
CVE-2026-115881
- CVSS
- —
- EPSS
- —
- Published
- —
- Modified
- —
In the news
4 storiesGoAhead TLS flaws accept revoked certificates and weaken sessions
GoAhead 6.1.1 fixes three TLS issues; FoxIO published proof-of-concept code, with no attacks reported.
72
GoAhead TLS flaws can ignore CRLs, weaken encryption, or bypass chain limits
FoxIO published PoCs for three configuration-specific bugs; GoAhead 6.1.1 fixes the OpenSSL and Mbed TLS issues.
71
GoAhead CRL check skip lets revoked client certificates pass mutual TLS
CVE-2026-115881 scores 9.1 on GoAhead 3.4.5–6.1.0 with mutual TLS and a loaded CRL; 6.1.1 fixes it.
58