FoxIO Discloses Three TLS Flaws in GoAhead Web Server

Security firm FoxIO has disclosed three vulnerabilities in how GoAhead, EmbedThis's lightweight web server, handles TLS. GoAhead runs management interfaces on networking gear, printers and industrial systems, and FoxIO says it is present on hundreds of millions of devices across IoT, OT, firewall and military sectors.

Researcher Sébastien Féry, who documented the flaws, said each one affects only a subset of deployments. Exposure depends on the TLS library a manufacturer built into the firmware and how certificate checks were configured.

The most severe, CVE-2026-115881 with a CVSS score of 9.1, affects GoAhead 3.4.5 through 6.1.0 built with OpenSSL or a compatible library and set up for mutual TLS with a certificate revocation list. The server reads the list but never tells OpenSSL to consult it, so a revoked certificate, such as one tied to a stolen device, is still accepted. Nothing at startup warns that revocation checks are inactive.

A second flaw, scored 5.9 and without a CVE, affects GoAhead 4.0.2 through 6.1.0 builds using Mbed TLS. A coding error weakens encryption on some TLS 1.2 connections enough that recorded sessions can be decrypted offline, but only if the client accepts the flawed parameters.

The third, CVE-2026-115884 at 7.4, affects GoAhead up to version 6.1.0 built with LibreSSL 3.2.x or 3.3.2 through 3.3.6. It only works against servers that require client certificates but accept them from any issuer.

Féry noted that none of the defects stops the affected handshake from completing. GoAhead 6.1.1, released Aug 2, resolves the OpenSSL and Mbed TLS issues, and advisories for all three were published Oct 12. Mbed TLS builds can also be protected by disabling finite-field DHE cipher suites or moving to the OpenSSL backend. For the LibreSSL issue, FoxIO recommends enabling issuer verification with a trusted CA bundle, or switching to OpenSSL or LibreSSL 4.x.

FoxIO released proof-of-concept code and fingerprints to help defenders find internet-facing GoAhead servers and identify their TLS library. Founder John Althouse named Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin and Boeing among companies whose devices rely on GoAhead, though FoxIO has not said whether any of their products use a vulnerable configuration. He cautioned that an upstream fix does not mean a patch exists for devices yet, since that is up to the manufacturer.

CVE references

CVE-2026-115881

CVE-2026-115884