GoAhead 6.1.1 fixes three TLS flaws in embedded web servers
Original title: Critical GoAhead TLS Flaws Could Expose Hundreds of Millions of Devices to Attacks
A critical OpenSSL-backend bug can accept revoked client certificates; the other flaws weaken DHE or chain checks.
FoxIO disclosed three flaws in GoAhead, an embedded web server used in routers, printers, gateways and industrial controllers. The critical issue, CVE-2026-115881, leaves CRL checking off in OpenSSL-compatible builds, so a revoked client certificate can complete mutual TLS. A medium Mbed TLS bug can shrink a Diffie-Hellman parameter so a passive observer may decrypt some TLS 1.2 sessions, and a high LibreSSL issue can accept an overly long chain. All three were fixed in GoAhead 6.1.1.
Unconfirmed: No real-world attacks are reported, and device fixes depend on each manufacturer shipping updated firmware.
- CVE-2026-115881 scores 9.1 and affects GoAhead 3.4.5 through 6.1.0 when a CRL is configured.
- A default build does not carry the revocation bug because the setup must be enabled deliberately.
- GOAHEAD-SA-2026-0005 scores 5.9 and a proof of concept recovered the shared secret after five attempts.
- CVE-2026-115884 scores 7.4 on LibreSSL legacy verifier builds 3.2.x and 3.3.2 through 3.3.6.
- Issues were reported privately in April 2026 and disclosed on October 12.
Impact: Revoked certificates accepted or some TLS sessions decryptable
| Product | Affected | Fixed in |
|---|---|---|
| GoAhead OpenSSL-compatible backend | 3.4.5 through 6.1.0 when a CRL is configured | 6.1.1 |
| GoAhead Mbed TLS backend | — | 6.1.1 |
| GoAhead LibreSSL legacy verifier | 3.2.x and 3.3.2 through 3.3.6 | 6.1.1 |
- 1.Upgrade OpenSSL-compatible builds from 3.4.5 through 6.1.0 to GoAhead 6.1.1.
- 2.Disable finite-field DHE suites or move Mbed TLS users to the OpenSSL backend.
- 3.Enable issuer verification, or move LibreSSL users to OpenSSL or LibreSSL 4.x, and check device-vendor firmware.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-115881 | — | — | — | ||
| CVE-2026-115884 | — | — | — |
From the original article
4 min read at cybersecuritynews.com
Three new security flaws affect GoAhead, a small web server that device makers build into routers, printers, gateways, and industrial controllers. The software runs in hundreds of millions of devices, including those used by Palo Alto Networks, Siemens, Honeywell, and Boeing. The flaws affect how these devices check digital certificates and protect encrypted traffic.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.