GoAhead TLS flaws silently accept revoked certificates and weaken encryption

EmbedThis released GoAhead version 6.1.1 on October 12, 2026, to address critical security flaws in its widely used embedded web server. The update fixes issues that allowed revoked client certificates to pass authentication and weakened encryption in certain TLS builds, affecting potentially hundreds of millions of IoT devices.

What happened

The primary vulnerability, identified as CVE-2026-115881 with a vendor-rated severity of 9.1, affects GoAhead builds using the OpenSSL backend with mutual TLS enabled. In these configurations, the server loads a certificate revocation list at startup but fails to enforce it. Consequently, clients presenting revoked certificates, such as those from stolen or retired devices, are silently accepted as valid. This flaw exists in versions 3.4.5 through 6.1.0 when operator-configured settings include a trusted certificate authority bundle, issuer checking, and a revocation list.

Researcher Sébastien Féry of FoxIO disclosed this issue alongside two other TLS-related problems on October 26, 2026. While the fix was provided to device makers on August 2, 2026, public disclosure followed in October. EmbedThis states that no active exploitation has been reported, though the coordinated release timing suggests no known attacks were underway at the time of publication.

Two additional vulnerabilities were addressed in the same release. One affects builds using older LibreSSL versions (3.2.x and 3.3.2–3.3.6), allowing certificate chains exceeding the ten-certificate limit to bypass validation when issuer checking is disabled. The other impacts Mbed TLS builds (versions 4.0.2 through 6.1.0), where a coding error causes the server to send a one-byte Diffie-Hellman value instead of the intended 2048-bit value. This weakness allows passive observers to decrypt sessions if the client accepts the malformed key exchange.

How it works

The OpenSSL flaw stems from a logic error where the revocation list is loaded into memory but never actively consulted during the handshake process. The server reports no errors during startup, giving operators a false sense of security. When a client presents a certificate, the server validates its signature against the trusted authority but skips the step of checking if that specific certificate serial number appears on the revocation list. This allows any certificate signed by a trusted authority to grant access, regardless of its revocation status.

The Mbed TLS issue involves a typo in the code handling finite-field Diffie-Hellman key exchanges. Instead of transmitting a robust 2048-bit public value, the server sends a single byte. Mainstream clients like modern browsers, Java, and Go reject this small value and abort the connection. However, embedded or custom clients lacking minimum size checks may accept it, establishing a weak session key that an eavesdropper can easily compute. This vulnerability does not affect TLS 1.3 or ECDHE sessions.

Key details

• CVE-2026-115881: Rated 9.1, affects OpenSSL builds 3.4.5–6.1.0 with mutual TLS and revocation lists configured; revoked certificates are accepted.
• CVE-2026-115884: Rated 7.4, affects LibreSSL 3.2.x and 3.3.2–3.3.6 builds; allows over-long certificate chains when issuer checking is off.
• Mbed TLS flaw: Rated 5.9, affects versions 4.0.2–6.1.0; sends 1-byte Diffie-Hellman values, enabling session decryption by passive observers.
• Fix availability: GoAhead 6.1.1 resolves all issues; device owners must wait for manufacturers to ship firmware updates containing this version.
• Additional fix: Version 6.1.1 also patches a login bypass allowing access with any password if the username is known and stored in Blowfish format.
• Detection: FoxIO offers JA4Scan tool fingerprints to identify GoAhead backends, though this identifies build type rather than confirmed vulnerability.

Why it matters

For engineers managing IoT infrastructure, this incident highlights the opacity of embedded software supply chains. GoAhead runs on routers, printers, and industrial controllers from major vendors like HP, Siemens, and D-Link. Because the TLS backend and settings are compiled into the firmware, device owners cannot determine their exposure without deep inspection or vendor confirmation. The delay between the fix release to manufacturers in August and public disclosure in October underscores the slow patching cycle typical of embedded devices, leaving systems vulnerable for extended periods.

The silent failure of revocation checking is particularly dangerous for environments relying on mutual TLS for device authentication. Operators who explicitly configure revocation lists to manage device lifecycle security are misled into believing their controls are active. This undermines trust in certificate-based authentication mechanisms, which are often the primary defense for headless devices lacking traditional user interfaces. The presence of a login bypass in the same release further compounds the risk, suggesting that multiple layers of defense may be compromised simultaneously.

What you can do

• Identify devices running GoAhead in your environment and contact manufacturers to confirm if they have shipped firmware based on version 6.1.1.
• If you control the firmware build process, upgrade to GoAhead 6.1.1 immediately and rebuild your images.
• For Mbed TLS builds, disable finite-field DHE suites or switch to the OpenSSL backend as an interim mitigation before updating.
• For LibreSSL builds, enable issuer checking with a trusted CA bundle or upgrade to LibreSSL 4.x if possible.
• After upgrading, end all active sessions, restart the server, and rotate any passwords stored in the Blowfish format.
• Use tools like JA4Scan to fingerprint GoAhead instances and determine which TLS backend they use, helping prioritize remediation efforts.