GoAhead 6.1.1 fixes TLS flaws: revoked certs accepted, DH downgrade

EmbedThis GoAhead — the embedded web server shipped inside routers, cameras, printers, and industrial gear — carries three TLS backend flaws that let revoked client certificates through, bypass certificate-chain depth limits, and passively decrypt sessions. Researcher Sébastien Féry of FoxIO documented all three in a write-up dated October 26. The fixed release is GoAhead 6.1.1, published to the public GitHub repo on October 12 after going to device makers on August 2.

A verification note up front: as of writing, the two assigned CVE IDs below were not yet live in the public CVE or NVD databases — EmbedThis has requested them, per The Hacker News. Link the vendor's GitHub Security Advisories, not NVD, until the records populate. Severity ratings are EmbedThis's own.

The three bugs

CVE-2026-115881 — revocation list loaded but never enforced (GHSA-5m75-xq69-c3c5, GOAHEAD-SA-2026-0006, CVSS 9.1). On the default OpenSSL backend, "GoAhead's OpenSSL backend loads the configured CRL into the certificate store but never enables revocation checking." A certificate you revoked still authenticates. Affected: GoAhead 3.4.5 through 6.1.0 with a CRL configured. The fix in 6.1.1 adds X509_STORE_set_flags(store, X509_V_FLAG_CRL_CHECK).

CVE-2026-115884 — chain-depth bypass on legacy LibreSSL (GHSA-r392-vqwx-3r4g, GOAHEAD-SA-2026-0004, CVSS 7.4). On builds against LibreSSL 3.2.x or 3.3.2–3.3.6 with VERIFY_PEER=1 and VERIFY_ISSUER=0, an over-depth client chain is accepted because the legacy verifier reports error 20 instead of a depth error. Affected: 6.1.0 and earlier on those LibreSSL versions.

Mbed TLS Diffie-Hellman truncation (GHSA-fmvx-2xfx-2gq4, GOAHEAD-SA-2026-0005, CVSS 5.9, no CVE assigned). A length typo — the code "uses sizeof(dhm_g) for both, even though dhm_g is only one byte long" — sends a one-byte DH value, letting a passive observer decrypt the session. Affected: 4.0.2 through 6.1.0 on the Mbed TLS backend with TLS 1.2 DHE_RSA suites.

Exploitation status

No in-the-wild use reported as of October 27. FoxIO has published proof-of-concept code and offers JA4Scan fingerprints to identify GoAhead servers by TLS backend; the tool's source is available on request. The 6.1.1 release closes 11 advisories in total, three rated critical.

Action checklist

1. Identify your TLS backend, not just your version. Which bug applies depends on whether GoAhead was built against OpenSSL (the default), LibreSSL, or Mbed TLS. Check your build flags before assuming you're clear.
2. Upgrade to GoAhead 6.1.1. It fixes CVE-2026-115881 and the Mbed TLS truncation outright. There is no interim option in the advisory for the CRL bug — if you rely on client-cert revocation, you are not enforcing it until you upgrade.
3. If you can't rebuild immediately on legacy LibreSSL, set VERIFY_ISSUER=1 with a trusted CA bundle, or move to the OpenSSL backend or LibreSSL 4.x to close CVE-2026-115884.
4. For the Mbed TLS backend, disable finite-field DHE suites or switch to OpenSSL if you can't patch today.
5. Pressure your device vendor. GoAhead is almost always a dependency inside someone else's firmware. The August 2 handoff to device makers means fixed firmware may exist — ask for a build that bundles 6.1.1.

Context

The common thread is that all three bugs are configuration honored on paper, not in code: a CRL that loads but never checks, an issuer flag that's silently tolerated, a DH length that's computed wrong. Operators who deployed mutual TLS on GoAhead for client-cert authentication were getting a weaker guarantee than their config implied. Because GoAhead rides inside embedded firmware, the patch gap here is measured in vendor release cycles, not IT patch windows — the kind of long-tail exposure that keeps revoked certificates working on edge devices long after the upstream fix lands.