TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices

What it is

FoxIO's Sébastien Féry documented three TLS flaws in GoAhead, the embedded web server from EmbedThis that runs management interfaces on networking gear, printers and industrial systems. The page says each flaw affects only a subset of deployments. Exposure depends on which TLS library the manufacturer built into the firmware and how certificate checks were configured. Advisories for all three were published on 12 October 2026.

Preconditions / Affected

• CVE-2026-115881 (CVSS 9.1): GoAhead 3.4.5 through 6.1.0, built with OpenSSL or a compatible library, configured for mutual TLS (mTLS) with a certificate revocation list (CRL).
• No CVE (CVSS 5.9): GoAhead 4.0.2 through 6.1.0 built with Mbed TLS. It affects TLS 1.2 connections, and only when the client accepts the flawed parameters.
• CVE-2026-115884 (CVSS 7.4): GoAhead up to 6.1.0 built with LibreSSL 3.2.x or 3.3.2 through 3.3.6. It only works against servers that require client certificates but accept them from any issuer.

How it works

For CVE-2026-115881, the server reads the CRL but never tells OpenSSL to consult it. A revoked certificate, such as one from a stolen or compromised device, is still accepted, even with issuer verification on. Nothing at startup warns that revocation checking is inactive.

For the Mbed TLS bug, a coding error weakens the encryption of some TLS 1.2 connections enough that recorded sessions can be decrypted offline.

For CVE-2026-115884, the certificate chain-length cap is the only safeguard in that configuration, and the bug bypasses it. Féry notes that none of the defects stops the affected handshake from completing.

What to do

• Upgrade to GoAhead 6.1.1 (released 2 August 2026). It fixes the OpenSSL and Mbed TLS issues, not the LibreSSL one.
• For Mbed TLS builds without the upgrade, turn off finite-field DHE cipher suites or move to the OpenSSL backend.
• For the LibreSSL issue, enable issuer verification with a trusted CA bundle, or switch to OpenSSL or LibreSSL 4.x.
• To find exposure, use the proof-of-concept code and fingerprints FoxIO released. They identify internet-facing GoAhead servers and the TLS library each one uses.

Caveats

An upstream fix does not mean device patches exist. FoxIO founder and CTO John Althouse said that depends on the manufacturer. He named Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin and Boeing as companies whose devices rely on GoAhead. FoxIO has not said whether any of their products use a vulnerable configuration. The page gives no fix for CVE-2026-115884 in GoAhead itself, only the configuration and library workarounds above.