Critical GoAhead TLS Flaws Expose Hundreds of Millions of Devices to Attacks
Three critical vulnerabilities in the widely used GoAhead web server could allow revoked certificates to be accepted, weak key exchange parameters to be used, and overly long certificate chains to pass, potentially exposing hundreds of millions of devices to attacks.
Researchers have uncovered three critical vulnerabilities affecting the GoAhead web server, a component embedded in hundreds of millions of devices worldwide, including products from major vendors like Siemens, Honeywell, and Palo Alto Networks. These flaws, discovered by FoxIO researchers led by Sébastien Féry, primarily impact how devices handle Transport Layer Security (TLS) certificates and protect encrypted traffic, potentially undermining device trust and data privacy.
The most severe issue, rated critical with a CVSS score of 9.1 and tracked as GOAHEAD-SA-2026-0006 and CVE-2026-115881, affects the OpenSSL-compatible backend of GoAhead. It allows revoked certificates to be accepted because the server fails to enable the necessary check for Certificate Revocation Lists (CRLs). While CRL checking is a standard security feature, GoAhead does not activate the specific flag required by OpenSSL to read and act upon these lists, meaning a certificate that has been explicitly revoked by its issuer could still be used to establish a trusted connection.
This critical flaw is particularly concerning as it affects versions of GoAhead from 3.4.5 through 6.1.0 when a CRL is configured. Although a default build might not carry this risk, and the feature must be deliberately enabled, the potential for exploitation on configured systems is significant. The researchers demonstrated that a revoked client certificate could still successfully complete a mutual TLS handshake, with verification callbacks reporting no errors, thereby bypassing a crucial security control.
A second vulnerability, affecting the Mbed TLS backend, is rated medium severity (CVSS 5.9) and tracked as GOAHEAD-SA-2026-0005. This flaw involves a small buffer length error that truncates a 2048-bit Diffie-Hellman modulus to a single byte, resulting in the server sending a weak value (255) to clients during the handshake. This drastically reduces the number of possible shared secrets to only eight, making it feasible for an observer to test each candidate against captured traffic and potentially decrypt sessions. The impact is limited to TLS 1.2 DHE_RSA sessions where the client accepts these weak parameters, and newer TLS versions or ECDHE sessions are not affected.
The third vulnerability, rated high severity (CVSS 7.4) and identified as GOAHEAD-SA-2026-0004 and CVE-2026-115884, impacts builds using LibreSSL's legacy verifier in specific versions (3.2.x and 3.3.2 through 3.3.6). This flaw allows for a certificate chain depth bypass. While GoAhead typically limits certificate chains to a depth of 10, this vulnerability allowed a 17-certificate chain rooted in a self-signed authority to pass verification when issuer checking was turned off, as LibreSSL reported an issuer error instead of a depth error. This could enable the acceptance of untrusted or improperly constructed certificate chains.
All three issues have been addressed in GoAhead version 6.1.1, released on October 12, 2026, following private reporting in April 2026. While the GoAhead maintainers describe 6.1.1 as a drop-in replacement, the responsibility for applying these patches ultimately falls on device manufacturers. Users of affected products are advised to check for firmware updates from their specific vendors, especially for devices used in critical infrastructure. Mitigation strategies vary by TLS backend, including upgrading, disabling specific cipher suites, or enabling stricter verification settings.
These vulnerabilities highlight the ongoing challenges in securing embedded devices and the critical role of diligent certificate and key management. The widespread use of GoAhead across various industries means that patching these flaws is essential to prevent potential disruptions, data breaches, and loss of trust in encrypted communications. The researchers also provide network fingerprinting tools to help identify affected systems.
This new report details two additional critical TLS vulnerabilities within the GoAhead embedded web server, impacting specific builds that use LibreSSL legacy verifier and Mbed TLS backends. The LibreSSL flaw allows for overly long client certificate chains to be accepted, while the Mbed TLS issue can lead to session decryption due to a typo in Diffie-Hellman parameters. These issues, alongside the previously reported certificate revocation bypass (CVE-2026-115881), are addressed in GoAhead 6.1.1.