# GoAhead Web Server TLS Vulnerabilities (CVE-2026-115881, CVE-2026-115884) Expose Embedded Devices

> Three backend-specific TLS integration flaws in the Embedthis GoAhead embedded web server allow revoked client certificates to be accepted (OpenSSL-compatible builds, CVSS 9.1), over-long certificate chains to pass validation (LibreSSL legacy verifier, CVSS 7.4), and a truncated Diffie-Hellman modulus that enables passive traffic decryption (Mbed TLS, CVSS 5.9). All are fixed in GoAhead 6.1.1; no in-the-wild exploitation has been reported.

- **Published:** 2026-10-27T17:42:13Z
- **Last reviewed:** 2026-10-27T17:42:13Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4556
- **ID:** TL-2026-4556
- **Severity:** CRITICAL (CVSS 9.1)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 5 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-115881, CVE-2026-115884

## Description

FoxIO researcher Sebastien Fery disclosed three independent TLS flaws in GoAhead, a widely embedded web server used in network appliances, industrial and consumer devices. Each flaw lives in the glue code between GoAhead and a specific TLS backend, so exposure depends on the backend a vendor compiled in. FoxIO states the product family is deployed across hundreds of millions of devices from vendors including Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin and Boeing. The hunt source article names Palo Alto Networks, Siemens, Honeywell and Boeing.

Flaw 1 (CVE-2026-115881, GOAHEAD-SA-2026-0006, CVSS 9.1, GoAhead 3.4.5-6.1.0, OpenSSL-compatible backend): GoAhead loads a Certificate Revocation List but never sets the OpenSSL CRL check flag (X509_V_FLAG_CRL_CHECK), so OpenSSL returns success without consulting the list. With mutual TLS enabled (ME_GOAHEAD_SSL_VERIFY_PEER=1), a CRL configured (ME_GOAHEAD_SSL_REVOKE) and issuer verification enabled (ME_GOAHEAD_SSL_VERIFY_ISSUER=1), a previously trusted but revoked client identity retains access. The 6.1.1 fix adds X509_STORE_set_flags(store, X509_V_FLAG_CRL_CHECK).

Flaw 2 (GOAHEAD-SA-2026-0005, CVSS 5.9, no CVE ID stated in sources, GoAhead 4.0.2-6.1.0, Mbed TLS backend): a buffer-length typo passes sizeof(dhm_g) for both the generator and the prime in mbedtls_ssl_conf_dh_param_bin. Because dhm_g is one byte, only the first byte (0xFF) of the 256-byte 2048-bit modulus is used. The shared secret then has only eight possible values (0x01, 0x02, 0x04 ... 0x80). A passive observer can try each candidate against captured TLS 1.2 DHE_RSA traffic; the FoxIO PoC recovered the correct secret within five attempts. OpenSSL clients reject the malformed parameters (modulus too small), so exposure depends on the client. Twenty-five DHE_RSA cipher suites are affected, including TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0x009F). The fix passes sizeof(dhm_p) for the prime.

Flaw 3 (CVE-2026-115884, GOAHEAD-SA-2026-0004, CVSS 7.4, GoAhead up to 6.1.0, LibreSSL legacy verifier 3.2.x and 3.3.2-3.3.6): when client certificate verification is on but issuer verification is off (ME_GOAHEAD_SSL_VERIFY_PEER=1, ME_GOAHEAD_SSL_VERIFY_ISSUER=0), the legacy verifier stops building the chain without recording a depth error. GoAhead receives X509 error 20 (unable to get local issuer) instead of error 22 (chain too long). A 17-certificate chain from an attacker-controlled CA completed the handshake against GoAhead 6.1.0 with LibreSSL 3.3.6 and returned HTTP 200 for protected resources, although the depth limit is 10.

Timeline per FoxIO: reports to the LibreSSL, Mbed TLS and OpenSSL projects on 2026-04-22, 04-27 and 04-30; GoAhead 6.1.1 (a drop-in replacement for 6.1.0) released 2026-08-02; advisories published 2026-10-12; FoxIO blog 2026-10-26. The CVE-to-flaw mapping comes from the FoxIO blog; the CVE IDs could not be cross-verified in NVD or via search at research time, and the CVSS vectors are not stated in the sources. No exploitation in the wild, IOCs or attribution have been reported. Defenders can fingerprint GoAhead TLS stacks with FoxIO JA4Scan and hunt for DHE cipher suites in JA4S values.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1040 Network Sniffing
- T1040 Network Sniffing
- T1557 Adversary-in-the-Middle
- T1557 Adversary-in-the-Middle

## Sources

- [Critical GoAhead TLS Flaws Could Expose Hundreds of Millions of Devices to Attacks](https://cybersecuritynews.com/goahead-tls-vulnerabilities/)
- [Choose Your Backend: Three TLS Bugs in GoAhead (FoxIO)](https://foxio.io/blog/choose-your-backend-three-tls-bugs-in-goahead)
- [FoxIO blog PoC - chooseyourbackend](https://github.com/FoxIO-LLC/blog_poc/tree/main/chooseyourbackend)
- [FoxIO JA4+ / JA4Scan repository](https://github.com/FoxIO-LLC/ja4)
- [Embedthis GoAhead GitHub repository (releases)](https://github.com/embedthis/goahead/releases)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4556