Three TLS implementation flaws in the GoAhead embedded web server could leave revoked device certificates valid, bypass certificate-chain limits or allow passive decryption of some sessions, researchers at FoxIO reported. GoAhead is embedded in routers, cameras, printers and industrial equipment, placing the bugs across a potentially large population of connected products. The vendor disclosed the issues in October after shipping fixes to device makers.
The most serious issue, CVE-2026-115881, affects GoAhead 3.4.5 through 6.1.0 when the OpenSSL-compatible backend is used with mutual TLS and a certificate revocation list configured. Rated 9.1 Critical under CVSS 3.1, the flaw loads the CRL but fails to enable OpenSSL’s revocation-checking flag, allowing a revoked client certificate to complete authentication. EmbedThis’s advisory identifies improper certificate validation as the underlying weakness and credits FoxIO researcher Sébastien Féry. [28]
A second issue, tracked by the vendor as GOAHEAD-SA-2026-0005, affects GoAhead 4.0.2 through 6.1.0 builds using mbed TLS. A length error causes the server to send a one-byte Diffie-Hellman modulus instead of the intended 2,048-bit parameter during TLS 1.2 DHE_RSA handshakes. FoxIO says an observer can test the small number of possible shared secrets and decrypt captured traffic, but exploitation depends on a client accepting the malformed parameters; TLS 1.3, ECDHE and OpenSSL builds are unaffected. The vendor rates the issue Medium at 5.9, and its advisory confirms version 6.1.1 as the patched release. [24]
The third flaw, CVE-2026-115884, carries a 7.4 High score and affects versions through 6.1.0 paired with LibreSSL 3.2.x or 3.3.2 through 3.3.6. Under the specific configuration requiring client certificates while disabling issuer checking, the legacy LibreSSL verifier can report an issuer error rather than a chain-depth error. GoAhead then accepts an overlong certificate chain despite its configured limit. Deployments that enable issuer checking with a trusted CA bundle, or use OpenSSL or LibreSSL 4.x, are not exposed to the demonstrated bypass. [2]
FoxIO published proof-of-concept code covering the TLS backend issues in its public GitHub repository. The research does not establish exploitation in the wild, and the issues do not appear in the CISA Known Exploited Vulnerabilities Catalog; there is also no reported threat-actor attribution. Exploitability therefore depends heavily on device configuration: the critical certificate issue requires mTLS and a configured CRL, while the decryption issue requires a permissive client and vulnerable cipher negotiation.
EmbedThis released GoAhead 6.1.1 to device builders on Aug. 2 and published the security advisories on Oct. 12. The release fixes all three defects, with vendor guidance also recommending that administrators disable finite-field DHE suites where upgrading is not immediately possible and enable issuer verification for affected LibreSSL deployments. Device manufacturers and operators should identify the TLS backend and library shipped in each product, update to 6.1.1 or a vendor-supplied backport, and avoid assuming that merely loading a CRL activates revocation enforcement. [17]
References
- Choose Your Backend: Three TLS Bugs in GoAhead
- Known Exploited Vulnerabilities Catalog
- Official Alerts & Statements – CISA
- CISA Adds Six Known Exploited Vulnerabilities to Catalog
