GoAhead TLS flaws can ignore CRLs, weaken encryption, or bypass chain limits
FoxIO published PoCs for three configuration-specific bugs; GoAhead 6.1.1 fixes the OpenSSL and Mbed TLS issues.
71
Product
Mbed TLS
- Mentions · 7d5
- Mentions · 30d5
- All mentions7
- First seenSep 17, 2026
- Last mentioned4d ago
Timeline
7 articles · newest firstGoAhead before 6.1.1 has three TLS bugs in crypto backends
A foxio.io write-up covers flaws in GoAhead's OpenSSL, LibreSSL, and Mbed TLS code; the note omits the details.
48
Three GoAhead TLS bugs skip CRLs, depth limits, or weaken DH
Fixes are in GoAhead 6.1.1 for the OpenSSL-compatible and mbed TLS cases; a public PoC decrypts weak DHE sessions.
74
GoAhead 6.1.1 fixes three TLS flaws in embedded web servers
A critical OpenSSL-backend bug can accept revoked client certificates; the other flaws weaken DHE or chain checks.
74
GoAhead TLS flaws accept revoked certificates and weaken sessions
GoAhead 6.1.1 fixes three TLS issues; FoxIO published proof-of-concept code, with no attacks reported.
72
China's Salt Typhoon backdoors Latin American orgs with new snooping malware
China-linked Salt Typhoon deployed new modular backdoor SparroWocky against Latin American government agencies since August 2025.
76
FamousSparrow Deploys New SparroWocky Backdoor Against Latin American Governments
China-aligned APT FamousSparrow deployed a new modular backdoor, SparroWocky, against government entities across eight Latin American countries since August 2025, ESET reports.
78
Related CVEs
by mentions- CVE-2021-26855100%9.1Unauthenticated SSRF/RCE in Microsoft Exchange Server (ProxyLogon)
Appears with
- LibreSSLproduct · 5
- OpenSSLproduct · 5
- GoAheadproduct · 4
- EmbedThisvendor · 3
- FoxIOorganization · 3
- ESETvendor · 2
- FamousSparrowthreat actor · 2
- SparroWockymalware · 2
- government of Argentinavictim · 1
- COFF Loaderproduct · 1
- SparrowDoormalware · 1
- government of Peruvictim · 1
- government of Panamavictim · 1
- Salt Typhoonthreat actor · 1
- government of Hondurasvictim · 1
- GoAheadvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.