Critical GoAhead TLS Flaws Could Expose Hundreds of Millions of Devices to Attacks

Three new security flaws affect GoAhead, a small web server that device makers build into routers, printers, gateways, and industrial controllers. The software runs in hundreds of millions of devices, including those used by Palo Alto Networks, Siemens, Honeywell, and Boeing. The flaws affect how these devices check digital certificates and protect encrypted traffic.

The flaw lies in GoAhead’s use of TLS libraries. TLS keeps web traffic private. In a mutual TLS setup, both the server and the client present digital certificates before they trust each other.

Researchers at FoxIO, led by Sébastien Féry, found that the flaws can let a revoked certificate pass, let an observer read some encrypted sessions, or let an overly long certificate chain get accepted. The real impact depends on which TLS library a device uses and how it is configured. Each issue was reported privately in April 2026, fixed in GoAhead 6.1.1, and disclosed in security advisories on October 12.

Trust in certificates has been under strain this month. Cyber Security News reported on the eMudhra certificate compromise, where private keys behind eight intermediate certificate authority certificates were exposed. Embedded TLS libraries have also drawn scrutiny, as seen in the wolfSSL vulnerabilities that put many connected devices at risk.

Revoked Certificates Still Work

The most serious issue is rated critical with a CVSS score of 9.1. It is tracked as GOAHEAD-SA-2026-0006 and CVE-2026-115881, and it affects the OpenSSL-compatible backend. A Certificate Revocation List, or CRL, is a file that names certificates no longer trusted. GoAhead loads this list, but it never turns on the check that reads it. OpenSSL needs a specific flag before it checks revocation, and GoAhead never sets that flag.

In testing on GoAhead 6.1.0 with OpenSSL 3.6.2, a revoked client certificate completed the mutual TLS handshake even with issuer verification enabled. The verification callback reported no error at any step. Versions 3.4.5 through 6.1.0 are affected when a CRL is configured.

The FoxIO research blog includes the code path and the test results. It notes that a default build does not carry this risk, since the setup must be turned on deliberately.

Weak Key Exchange Parameters

The Mbed TLS backend has a medium-severity flaw, scored 5.9 and tracked as GOAHEAD-SA-2026-0005. A small mistake in a buffer length cut a 2048-bit Diffie-Hellman modulus down to a single byte.

The server then sent the value 255 to clients during the handshake. With only eight possible shared secrets left, an observer can test each candidate against captured traffic. In a proof of concept, the researcher recovered the correct value after five attempts.

Exposure is narrower than the critical flaw. The problem only matters for TLS 1.2 DHE_RSA sessions with a client that accepts the broken parameters.

The tested OpenSSL client rejected them, and ECDHE sessions and TLS 1.3 are not affected. Still, custom or embedded clients without a minimum-size check could complete a session that a passive observer can decrypt.

Certificate Chain Depth Bypass

The third issue is rated High with a CVSS score of 7.4. It is tracked as GOAHEAD-SA-2026-0004 and CVE-2026-115884, and it affects builds that use LibreSSL’s legacy verifier in versions 3.2.x and 3.3.2 through 3.3.6.

GoAhead limits certificate chains to a depth of 10. In testing, a 17-certificate chain rooted in a self-signed authority still passed. LibreSSL reported an issuer error instead of a depth error, and GoAhead accepted that error when issuer checking was turned off. The same code built on LibreSSL 4.3.1 rejected the chain. The GoAhead 6.1.1 release notes on GitHub list the fix and the advisory details.

GoAhead 6.1.1 fixes all three issues, and the maintainers describe it as a drop-in replacement for 6.1.0. Operators on OpenSSL-compatible builds from 3.4.5 through 6.1.0 should upgrade. Mbed TLS users should upgrade, disable finite-field DHE suites, or move to the OpenSSL backend. LibreSSL users should enable issuer verification with a trusted CA bundle, or move to OpenSSL or LibreSSL 4.x.

A GoAhead fix does not reach devices on its own. FoxIO founder and CTO John Althouse warned on X that a patch from GoAhead does not mean a patch exists for each device, since that depends on the manufacturer. Teams should check firmware updates with their device vendors, especially for equipment that supports critical infrastructure.

Security teams can look for affected systems with network fingerprints. FoxIO’s JA4Scan tool actively probes TLS servers and maps them to the library they run. FoxIO lists sample fingerprints for GoAhead 6.1.x builds on OpenSSL, LibreSSL, and mbed TLS. Defenders can also search logs for the DHE cipher suites tied to the Mbed TLS flaw.

The three bugs show how small errors in certificate and key handling can weaken a device. Owners of GoAhead-based products should confirm their TLS backend, check their settings, and apply vendor updates as soon as they arrive.

AI is making cyberattacks faster and cheaper. Are your defenses ready to respond at machine speed?

The post Critical GoAhead TLS Flaws Could Expose Hundreds of Millions of Devices to Attacks appeared first on Cyber Security News.