Three GoAhead TLS Flaws Put Device Security at Risk

Cybersecurity firm FoxIO has disclosed three vulnerabilities in GoAhead, a lightweight web server used in the management interfaces of networking equipment, printers and industrial systems. FoxIO estimates that GoAhead runs on hundreds of millions of devices in the internet of things, operational technology, firewall and military sectors.

The risks depend on the TLS library included in a device’s firmware and the certificate checks selected by its manufacturer. Each vulnerability affects only certain configurations, according to Sébastien Féry, the FoxIO researcher who documented the flaws.

The most serious flaw, CVE-2026-115881, has a CVSS score of 9.1. It affects GoAhead versions 3.4.5 through 6.1.0 when they use OpenSSL or a compatible library, require mutual TLS and have a certificate revocation list configured.

In affected builds, GoAhead reads the revocation list but does not instruct OpenSSL to use it during certificate checks. A certificate revoked after being stolen or compromised can therefore still be accepted, even when issuer verification is enabled. The server does not warn administrators at startup that revocation checks are inactive.

The second flaw has a CVSS score of 5.9 and has not been assigned a CVE. It affects GoAhead versions 4.0.2 through 6.1.0 when built with Mbed TLS. A coding error weakens the encryption parameters used by some TLS 1.2 connections. An attacker who records the traffic could decrypt it later if the client accepts the affected parameters.

The third vulnerability, CVE-2026-115884, has a CVSS score of 7.4. It affects GoAhead versions up to 6.1.0 when built with LibreSSL 3.2.x or versions 3.3.2 through 3.3.6.

The flaw can bypass a limit on the length of a client-certificate chain. It affects servers that require client certificates but accept certificates from any issuer. In that configuration, the chain-length limit is the only protection against the attack described by FoxIO.

“None of these defects prevents the affected handshake from completing,” Féry wrote in documentation published with the disclosures. FoxIO published advisories for the three vulnerabilities on Oct. 12 and released proof-of-concept code and fingerprints to help defenders identify internet-facing GoAhead servers and determine which TLS library they use.

GoAhead 6.1.1, released Aug. 2, fixes the OpenSSL and Mbed TLS issues. For Mbed TLS deployments, FoxIO recommends disabling finite-field Diffie-Hellman ephemeral cipher suites or switching to the OpenSSL backend. For the LibreSSL flaw, it recommends enabling issuer verification with a trusted certificate-authority bundle or moving to OpenSSL or LibreSSL 4.x.

An upstream release does not confirm that affected products have received an update. FoxIO founder and Chief Technology Officer John Althouse identified devices from Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin and Boeing as using GoAhead. FoxIO has not said whether products from those companies use vulnerable configurations.

Althouse wrote on X that the availability of a GoAhead fix “doesn’t mean there’s a patch available for the devices yet — that’s up to the manufacturer.”