{"id":"TECH-202610-goahead-embedded-web-server-tls-bugs-accept-revoked-client-c","kind":"technique","aliases":[],"related":[],"title":"GoAhead embedded web server TLS bugs accept revoked client certificates and make some TLS 1.2 sessions decryptable","description":null,"summary":"FoxIO disclosed three TLS bugs in Embedthis GoAhead, the embedded web server behind device-management pages in routers, firewalls, printers, and OT/IoT gear (they name Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, and Digi). (1) OpenSSL-compatible backend, GoAhead 3.4.5-6.1.0: a configured CRL is loaded but never enforced, so revoked mTLS client certificates are still accepted (CVSS 9.1, GOAHEAD-SA-2026-0006). (2) LibreSSL legacy verifier (3.2.x, 3.3.2-3.3.6) with VERIFY_PEER=1 and VERIFY_ISSUER=0, GoAhead <=6.1.0: the chain-depth limit is not enforced (CVSS 7.4, GOAHEAD-SA-2026-0004). (3) Mbed TLS backend, GoAhead 4.0.2-6.1.0: a length typo cuts the 2048-bit DH prime to one byte, so a passive observer can decrypt TLS 1.2 DHE_RSA sessions when the client accepts the parameters (CVSS 5.9, GOAHEAD-SA-2026-0005). Only certain builds and configurations are affected. The bugs were disclosed 2026-10-26 with a fix in GoAhead 6.1.1. No CVE IDs yet and no exploitation reported. Devices only get the fix through vendor firmware updates.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"GoAhead","fixed":["6.1.1"],"vendor":"Embedthis","affected":">=3.4.5 <=6.1.0"}],"ecosystems":[],"tags":["early-warning","technique"],"not_affected_if":[],"how_to_check":"Find devices and firmware that ship GoAhead older than 6.1.1 (Server header or banner, firmware SBOM). Then check the build: OpenSSL backend with mTLS and ME_GOAHEAD_SSL_REVOKE set; Mbed TLS backend offering TLS 1.2 DHE_RSA suites (look for DHE_RSA suites such as 0x009F in JA4S logs, e.g. t120100_009f_1ca028f07214, or a ServerKeyExchange with a 1-byte DH prime 0xFF); LibreSSL 3.2.x/3.3.2-3.3.6 with VERIFY_PEER=1 and VERIFY_ISSUER=0.","fix":"If you build GoAhead into a product, upgrade to 6.1.1 or later. If you run devices, ask the vendor for firmware with GoAhead 6.1.1 and apply it. Until then: turn off finite-field DHE suites (use ECDHE or TLS 1.3); for LibreSSL builds set VERIFY_ISSUER=1 with a trusted CA bundle or move to OpenSSL or LibreSSL 4.x; do not rely on CRL revocation for GoAhead mTLS (rotate the CA or remove the revoked identities another way); and keep device-management interfaces off untrusted networks.","status":"open","published_at":null,"first_seen_at":"2026-10-27T05:52:19+00:00","triaged_at":"2026-10-27T05:52:19+00:00","updated_at":"2026-10-27T05:52:19+00:00","category":"infrastructure","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-0004':141B '-0005':184B '-0006':108B '-10':197B '-202610':19A '-26':198B '0':124B '1':78B,120B '1.2':15A,168B '2':109B '2026':107B,140B,183B,196B '2048':154B '3':142B '3.2':113B '3.3.2':115B '3.3.6':116B '3.4.5':84B '4.0.2':147B '5.9':179B '6.1.0':85B,126B,148B '6.1.1':204B '7.4':136B '9.1':103B 'accept':7A,27A,101B,175B 'affect':191B 'alto':63B 'backend':82B,145B 'behind':48B 'bit':155B 'bug':6A,40B,193B 'bugs':26A 'build':187B 'byte':160B 'c':30A 'canon':70B 'certain':186B 'certif':10A,98B 'chain':129B 'chain-depth':128B 'client':9A,29A,97B,174B 'comcast':65B 'compat':81B 'configur':87B,189B 'crl':88B 'cut':152B 'cve':206B 'cvss':102B,135B,178B 'd':67B 'd-link':66B 'decrypt':17A,166B 'depth':130B 'devic':50B,213B 'device-manag':49B 'dh':156B 'dhe':169B 'digi':77B 'disclos':37B,195B 'earli':33B 'early-warn':32B 'embed':2A,45B 'embedded':22A 'embedthi':42B 'enforc':93B,134B 'exploit':211B 'firewal':55B 'firmwar':220B 'fix':201B,217B 'foxio':36B 'ge':72B 'gear':59B 'get':215B 'goahead':1A,21A,31A,43B,83B,105B,125B,138B,146B,181B,203B 'goahead-embedded-web-server-tls-bugs-accept-revoked-client-c':20A 'goahead-sa':104B,137B,180B 'honeywel':71B 'hp':69B 'id':207B 'issuer':123B 'legaci':111B 'length':150B 'libressl':110B 'limit':131B 'link':68B 'load':90B 'make':12A 'manag':51B 'mbed':143B 'mtls':96B 'name':61B 'network':64B 'never':92B 'observ':164B 'one':159B 'openssl':80B 'openssl-compat':79B 'oracl':73B 'ot/iot':58B 'page':52B 'palo':62B 'paramet':177B 'passiv':163B 'peer':119B 'prime':157B 'printer':56B 'report':212B 'revok':8A,95B 'revoked':28A 'rockwel':75B 'router':54B 'rsa':170B 'sa':106B,139B,182B 'server':4A,24A,47B 'session':16A,171B 'siemen':74B 'still':100B 'tech':18A 'techniqu':35B 'three':38B 'tls':5A,14A,25A,39B,144B,167B 'typo':151B 'updat':221B 'vendor':219B 'verifi':112B,118B,122B 'warn':34B 'web':3A,23A,46B 'x':114B 'yet':208B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"TECH-202610-goahead-embedded-web-server-tls-bugs-accept-revoked-client-c","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-27T05:52:19+00:00","fetched_at":"2026-10-27T05:52:19+00:00","note":null}],"documents":[{"id":5261,"url":"https://x.com/_r_netsec/status/2114953578230292590","title":"@_r_netsec: Choose Your Backend: Three TLS Bugs in GoAhead https://t.co/oGXcgqNOEx","kind":"post","source":"x","text":"Choose Your Backend: Three TLS Bugs in GoAhead https://t.co/oGXcgqNOEx\n\nlikes 0 reposts 0","published_at":"2026-10-27T05:33:21+00:00","relation":"describes","confidence":null,"note":null},{"id":5319,"url":"https://t.co/oGXcgqNOEx","title":"Choose Your Backend: Three TLS Bugs in GoAhead (FoxIO, Sébastien Féry)","kind":"blog","source":"analyst","text":"FoxIO write-up: three TLS bugs in GoAhead embedded web server. (1) OpenSSL-compatible backend, GoAhead 3.4.5-6.1.0: CRL loaded but X509_V_FLAG_CRL_CHECK never set, revoked mTLS client certs accepted; CVSS 9.1, GOAHEAD-SA-2026-0006. (2) LibreSSL legacy verifier 3.2.x/3.3.2-3.3.6, GoAhead <=6.1.0, VERIFY_PEER=1 and VERIFY_ISSUER=0: over-depth client chain accepted; CVSS 7.4, GOAHEAD-SA-2026-0004. (3) Mbed TLS backend, GoAhead 4.0.2-6.1.0: sizeof(dhm_g) used for DH modulus length, 2048-bit DH prime reduced to 1 byte (0xFF); TLS 1.2 DHE_RSA sessions passively decryptable if client accepts the params; CVSS 5.9, GOAHEAD-SA-2026-0005. Fix: GoAhead 6.1.1; mitigations: disable finite-field DHE suites, enable VERIFY_ISSUER=1 with CA bundle, or use OpenSSL / LibreSSL 4.x. Affected vendors named include Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi. No exploitation reported.","published_at":"2026-10-26T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}