TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices
Source SecurityWeek
Mentioned vulnerabilities
Rated High by Threat Radar's AI analysis
Data as of 28 Oct 2026, 16:57 UTC
What to do
AI-suggested
GoAhead 6.1.1, released August 2, 2026, fixes the OpenSSL and Mbed TLS vulnerabilities. For Mbed TLS builds, disabling finite-field DHE cipher suites or switching to the OpenSSL backend can mitigate the issue. For the LibreSSL vulnerability, enabling issuer verification with a trusted CA bundle or upgrading to LibreSSL 4.x or switching to OpenSSL is recommended. Device manufacturers must deploy these fixes in firmware updates. FoxIO has released detection fingerprints and proof-of-concept code to help defenders identify affected devices. Organizations should verify device TLS library configurations and update to patched versions where possible. Since patch deployment depends on manufacturers, monitoring vendor advisories for device-specific updates is essential.
Description
Three TLS vulnerabilities were disclosed in the GoAhead web server used in hundreds of millions of devices across IoT, OT, firewall, and military sectors. The critical flaw (CVE-2026-115881) affects versions 3.4.5 through 6.1.0 built with OpenSSL or compatible libraries configured for mutual TLS with certificate revocation lists, allowing revoked certificates to be accepted. Another flaw affects versions 4.0.2 through 6.1.0 built with Mbed TLS, weakening encryption of some TLS 1.2 connections and enabling offline decryption of recorded sessions if clients accept flawed parameters. A third flaw (CVE-2026-115884) impacts versions up to 6.1.0 built with LibreSSL 3.2.x or 3.3.2 through 3.3.6, bypassing certificate chain length limits under certain configurations. GoAhead 6.1.1 fixes the OpenSSL and Mbed TLS issues, and mitigations exist for the LibreSSL issue. The availability of upstream fixes does not guarantee device patches, which depend on manufacturers.