---
id: "TECH-202610-goahead-embedded-web-server-tls-bugs-accept-revoked-client-c"
kind: "technique"
aliases: []
title: "GoAhead embedded web server TLS bugs accept revoked client certificates and make some TLS 1.2 sessions decryptable"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "GoAhead", "fixed": ["6.1.1"], "vendor": "Embedthis", "affected": ">=3.4.5 <=6.1.0"}]
ecosystems: []
tags: ["early-warning", "technique"]
not_affected_if: []
published_at: null
first_seen_at: "2026-10-27T05:52:19+00:00"
updated_at: "2026-10-27T05:52:19+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-27T05:52:19+00:00"}]
---

# GoAhead embedded web server TLS bugs accept revoked client certificates and make some TLS 1.2 sessions decryptable

FoxIO disclosed three TLS bugs in Embedthis GoAhead, the embedded web server behind device-management pages in routers, firewalls, printers, and OT/IoT gear (they name Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, and Digi). (1) OpenSSL-compatible backend, GoAhead 3.4.5-6.1.0: a configured CRL is loaded but never enforced, so revoked mTLS client certificates are still accepted (CVSS 9.1, GOAHEAD-SA-2026-0006). (2) LibreSSL legacy verifier (3.2.x, 3.3.2-3.3.6) with VERIFY_PEER=1 and VERIFY_ISSUER=0, GoAhead <=6.1.0: the chain-depth limit is not enforced (CVSS 7.4, GOAHEAD-SA-2026-0004). (3) Mbed TLS backend, GoAhead 4.0.2-6.1.0: a length typo cuts the 2048-bit DH prime to one byte, so a passive observer can decrypt TLS 1.2 DHE_RSA sessions when the client accepts the parameters (CVSS 5.9, GOAHEAD-SA-2026-0005). Only certain builds and configurations are affected. The bugs were disclosed 2026-10-26 with a fix in GoAhead 6.1.1. No CVE IDs yet and no exploitation reported. Devices only get the fix through vendor firmware updates.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :GoAhead affected >=3.4.5 <=6.1.0 fixed 6.1.1

## How to check

Find devices and firmware that ship GoAhead older than 6.1.1 (Server header or banner, firmware SBOM). Then check the build: OpenSSL backend with mTLS and ME_GOAHEAD_SSL_REVOKE set; Mbed TLS backend offering TLS 1.2 DHE_RSA suites (look for DHE_RSA suites such as 0x009F in JA4S logs, e.g. t120100_009f_1ca028f07214, or a ServerKeyExchange with a 1-byte DH prime 0xFF); LibreSSL 3.2.x/3.3.2-3.3.6 with VERIFY_PEER=1 and VERIFY_ISSUER=0.

## Fix

If you build GoAhead into a product, upgrade to 6.1.1 or later. If you run devices, ask the vendor for firmware with GoAhead 6.1.1 and apply it. Until then: turn off finite-field DHE suites (use ECDHE or TLS 1.3); for LibreSSL builds set VERIFY_ISSUER=1 with a trusted CA bundle or move to OpenSSL or LibreSSL 4.x; do not rely on CRL revocation for GoAhead mTLS (rotate the CA or remove the revoked identities another way); and keep device-management interfaces off untrusted networks.

## Timeline

- 2026-10-27T05:52:19+00:00 analyst

## Documents

- [describes] @_r_netsec: Choose Your Backend: Three TLS Bugs in GoAhead https://t.co/oGXcgqNOEx https://x.com/_r_netsec/status/2114953578230292590
- [describes] Choose Your Backend: Three TLS Bugs in GoAhead (FoxIO, Sébastien Féry) https://t.co/oGXcgqNOEx

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_