● Covered by 3 sources · 3 reportsMedium impact2 negative1 neutral
GoAhead Embedded Web Server Patches Three TLS Vulnerabilities
Key points
- Three TLS vulnerabilities found in GoAhead embedded web server.
- Flaws affect devices from vendors like Palo Alto Networks, HP, and Siemens.
- Vulnerabilities include accepting revoked certificates, session decryption, and chain depth bypass.
- Impact depends on the TLS backend used (OpenSSL, LibreSSL, Mbed TLS).
- GoAhead 6.1.1, released August 2, 2026, fixes these issues.
- FoxIO disclosed the vulnerabilities.
- GoAhead is used in hundreds of millions of IoT, OT, firewall, and military devices.
- Advisories for the flaws were published on October 12.
- CVE-2026-115881 (CVSS 9.1) affects GoAhead 3.4.5 through 6.1.0 with OpenSSL and mTLS.
Multiple TLS Vulnerabilities Discovered
Three independent TLS vulnerabilities have been identified in the GoAhead embedded web server. These flaws, discovered by Sébastien Féry of FoxIO, affect various configurations of the server's TLS backends. GoAhead is widely used in firmware for devices such as routers, printers, gateways, and industrial controllers, with its maker EmbedThis stating it runs in hundreds of millions of devices from vendors including Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, and Boeing.
Specific Vulnerabilities and Impact
The vulnerabilities vary in severity and impact based on the TLS library and verification settings implemented. One critical flaw (CVSS 9.1, GOAHEAD-SA-2026-0006) affects builds using the OpenSSL-compatible backend with mutual-TLS. In this scenario, a certificate revocation list (CRL) is loaded but revocation checking is not enabled, allowing revoked client certificates to be silently accepted. An operator configuring such a setup would have no indication that revocation is not functioning.
Another high-severity bug (CVSS 7.4, GOAHEAD-SA-2026-0004) impacts the LibreSSL legacy verifier. This flaw allows an over-depth client certificate chain to be accepted when client certificates are required but issuer checking is disabled, thereby bypassing configured chain-depth restrictions.
A medium-severity issue (CVSS 5.9, GOAHEAD-SA-2026-0005) is present in the Mbed TLS backend. A buffer-length typo reduces a 2048-bit Diffie-Hellman (DH) modulus to one byte. This can make TLS 1.2 DHE_RSA sessions decryptable if the client accepts the broken parameters.
Resolution and Availability
The identified vulnerabilities have been addressed in GoAhead version 6.1.1. This version was released to device makers on August 2, 2026, and publicly published on October 12, 2026. Device manufacturers are responsible for integrating this updated version into their firmware to mitigate the risks associated with these TLS flaws.
Context of GoAhead Usage
GoAhead serves as a small embedded web server that device makers integrate into firmware to manage various device functions, including running management pages. Its widespread deployment across IoT, firewall, operational technology (OT), and military devices underscores the importance of these security patches for maintaining the integrity and security of critical infrastructure and consumer products.
Updates
- FoxIO disclosed the vulnerabilities.
- GoAhead is used in hundreds of millions of IoT, OT, firewall, and military devices.
- Advisories for the flaws were published on October 12.
- CVE-2026-115881 (CVSS 9.1) affects GoAhead 3.4.5 through 6.1.0 with OpenSSL and mTLS.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub embedthis/goahead CVE CVE-2026-115881 CVE CVE-2026-115884 GitHub FoxIO-LLC/ja4 GitHub FoxIO-LLC/blog_pocHow outlets covered it
Cybersecurity firm FoxIO disclosed three TLS vulnerabilities in the GoAhead web server, which is used in hundreds of millions of IoT, OT, firewall, and military devices. These flaws could allow revoked certificates to remain active, enable eavesdropping on some traffic, or bypass certificate chain length limits. GoAhead 6.1.1, released on August 2, resolves two of the issues, and advisories were published on October 12.
Three independent TLS bugs were found in the GoAhead embedded web server, affecting devices from major vendors. These vulnerabilities could allow revoked client certificates to be accepted, enable decryption of encrypted sessions, or bypass certificate chain depth limits, depending on the TLS backend used.
The GoAhead embedded web server contained a flaw (CVE-2026-115881) where revoked client certificates were accepted due to revocation checking not being enabled, despite a revocation list being configured. This vulnerability affects builds using the OpenSSL backend with mutual-TLS, potentially allowing unauthorized access to devices like routers and printers.