GoAhead 6.1.1 fixes TLS flaws; LibreSSL fix is disputed
October 28: SecurityWeek says 6.1.1 does not fix the LibreSSL chain-length bug, and that FoxIO published fingerprints without naming vendors using a vulnerable setup.
FoxIO’s public proof of concept covers three library-specific GoAhead TLS bugs; 6.1.1 fixes the OpenSSL and Mbed TLS issues, while the LibreSSL fix is disputed.
FoxIO disclosed three configuration-specific TLS bugs in EmbedThis GoAhead, an embedded web server FoxIO says is used in large numbers of IoT, OT, firewall, and military devices. CVE-2026-115881 (CVSS 9.1) affects OpenSSL-compatible builds 3.4.5 through 6.1.0 when a certificate revocation list is configured: the list is loaded but not enforced, so a revoked client certificate can complete mutual TLS. Cyber Security News says a default build is unaffected unless that option is enabled. On Mbed TLS builds 4.0.2 through 6.1.0, GOAHEAD-SA-2026-0005 (CVSS 5.9, no CVE according to The Hacker News) can send a one-byte Diffie-Hellman value; FoxIO’s proof of concept decrypted a TLS 1.2 DHE_RSA session. CVE-2026-115884 (CVSS 7.4) can accept an over-long client chain on listed older LibreSSL builds. The Hacker News reported no attacks as of October 27. SecurityWeek says 6.1.1 does not fix the LibreSSL issue, while The Hacker News, Cyber Security News, and GBHackers say 6.1.1 fixes all three.
- CVE-2026-115881 scores 9.1 on OpenSSL builds 3.4.5–6.1.0 with a configured CRL.
- Mbed TLS issue scores 5.9, spans 4.0.2–6.1.0, and has no CVE per The Hacker News.
- CVE-2026-115884 scores 7.4 on listed LibreSSL builds 3.2.x and 3.3.2–3.3.6.
- TLS 1.3 and ECDHE are unaffected by the weak Diffie-Hellman parameters.
- FoxIO released proof-of-concept code and fingerprints but named no vulnerable vendor products.
Timeline
dated events in the reporting · oldest first- Aug 2, 2026GoAhead 6.1.1 made available to device builders · GBHackers
- Oct 12, 2026Advisories and public disclosure of the three TLS bugs · SecurityWeek
- Oct 27, 2026No attacks reported; oss-security note posted · The Hacker News
What each outlet adds
beyond the shared facts- SecurityWeekSays 6.1.1 does not fix the LibreSSL issue; fingerprints, no named vendors.
- Cyber Security NewsDefault builds unaffected unless CRL checking is deliberately enabled.
- Hacker News · AIEight possible shared secrets; tested OpenSSL clients rejected the tiny modulus.
- The Hacker NewsNo attacks reported as of October 27; Mbed TLS issue has no CVE.
- GBHackersOpenSSL path loads a CRL but never sets X509_V_FLAG_CRL_CHECK.
- Organizations
- FoxIO
Coverage
oldest first · one row per article · UTC- · 3d ago
The Hacker NewsFirst report
GoAhead TLS flaws accept revoked certificates and weaken sessions
GoAhead 6.1.1 fixes three TLS issues; FoxIO published proof-of-concept code, with no attacks reported.
- · 3d ago
Cyber Security News
GoAhead 6.1.1 fixes three TLS flaws in embedded web servers
A critical OpenSSL-backend bug can accept revoked client certificates; the other flaws weaken DHE or chain checks.
- · 3d ago
Hacker News · AI
Three GoAhead TLS bugs skip CRLs, depth limits, or weaken DH
Fixes are in GoAhead 6.1.1 for the OpenSSL-compatible and mbed TLS cases; a public PoC decrypts weak DHE sessions.
- · 2d ago
oss-security
GoAhead before 6.1.1 has three TLS bugs in crypto backends
A foxio.io write-up covers flaws in GoAhead's OpenSSL, LibreSSL, and Mbed TLS code; the note omits the details.
- · 2d ago
GBHackers
GoAhead CRL check skip lets revoked client certificates pass mutual TLS
CVE-2026-115881 scores 9.1 on GoAhead 3.4.5–6.1.0 with mutual TLS and a loaded CRL; 6.1.1 fixes it.
- · 2d ago
SecurityWeek
GoAhead TLS flaws can ignore CRLs, weaken encryption, or bypass chain limits
FoxIO published PoCs for three configuration-specific bugs; GoAhead 6.1.1 fixes the OpenSSL and Mbed TLS issues.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-115881 | — | — | — | ||
| CVE-2026-115884 | — | — | — |