Three TLS Bugs in GoAhead web server: revoked certs accepted, DH truncation, chain-depth bypass (no CVEs)
Severity: critical · Patch status: patched · Since 2026-10-28
FoxIO disclosed three independent TLS bugs in EmbedThis GoAhead <= 6.1.0, fixed in 6.1.1. With the OpenSSL-compatible backend (=3.4.5), a CRL is loaded but never enforced, so revoked client certificates are silently accepted in mTLS deployments (CVSS 9.1, GOAHEAD-SA-2026-0006). LibreSSL legacy-verifier builds (3.2.x, 3.3.2-3.3.6) with VERIFYPEER=1 and VERIFYISSUER=0 accept over-depth client certificate chains, bypassing the chain-depth limit (CVSS 7.4, GOAHEAD-SA-2026-0004). The Mbed TLS backend (=4.0.2) has a buffer-length typo in sslOpen() that reduces the 2048-bit DH modulus to one byte, making TLS 1.2 DHERSA sessions decryptable to observers (CVSS 5.9, GOAHEAD-SA-2026-0005). GoAhead is embedded in vast numbers of IoT, firewall, OT and military devices (Palo Alto, D-Link, HP, Canon, Siemens, Boeing, etc.). No in-the-wild exploitation reported; GHSA advisories published.
What to do
- Upgrade GoAhead to 6.1.1 or later, or apply vendor firmware updates for devices embedding GoAhead
- If upgrade is not immediate, disable finite-field DHE cipher suites or switch to the OpenSSL backend (Mbed TLS issue)
- Enable VERIFY_ISSUER=1 with a trusted CA bundle or use OpenSSL/LibreSSL 4.x (LibreSSL legacy verifier issue)
- Audit mTLS deployments for reliance on CRL revocation checking and re-evaluate trust in previously revoked client certificates
- Inventory devices and products that embed GoAhead and track vendor advisories
Fixed versions
Sources
All live incidents on Threat Watch
