Do Son 
TL;DR
FoxIO has published full details and proof-of-concept code for three GoAhead TLS vulnerabilities. The worst scores 9.1 on CVSS and lets revoked client certificates pass mutual TLS checks. GoAhead is an embedded web server that, according to FoxIO, runs in “hundreds of millions” of devices.
Three separate bugs in GoAhead’s TLS backends can accept revoked certificates, expose encrypted sessions or skip a chain-depth limit. Each bug depends on the TLS library and build settings. GoAhead 6.1.1 fixes all three, and the reproduction code is now public on GitHub.
Why It Matters
GoAhead serves the management interfaces of routers, switches, printers, gateways and industrial controls. FoxIO names devices from vendors such as Palo Alto Networks, D-Link, HP, Canon, Siemens and Rockwell. As a result, a single library bug can reach many products.
Each vendor must still ship the fix in its own firmware. FoxIO also published the proof-of-concept code alongside the write-up, so these GoAhead TLS vulnerabilities now have public test code.
How the Attack Works
Revoked certificates still accepted (CVSS 9.1)
Tracked as GOAHEAD-SA-2026-0006, this critical bug affects the OpenSSL-compatible backend. FoxIO explains that GoAhead “loads the configured CRL into the certificate store but never enables revocation checking.” Consequently, a revoked client certificate can still finish the mTLS handshake. Worse, the server shows no warning that CRL checks are off.
In FoxIO’s words, “a previously trusted but revoked identity retains access.”
Chain-depth limit bypass (CVSS 7.4)
GOAHEAD-SA-2026-0004 affects builds using the legacy verifier in LibreSSL 3.2.x and 3.3.2 through 3.3.6. Here, an over-long certificate chain triggers an issuer error instead of a depth error. GoAhead tolerates that issuer error when issuer checking is turned off. FoxIO notes this “bypasses the chain-depth restriction.”
Truncated Diffie-Hellman key (CVSS 5.9)
GOAHEAD-SA-2026-0005 hits the Mbed TLS backend. A buffer-length typo “reduces a 2048-bit DH modulus to one byte.” That leaves only eight possible shared secrets. Therefore, a passive observer could decrypt captured TLS 1.2 DHE_RSA sessions. However, this only works when the client accepts the broken parameters. FoxIO found that a standard OpenSSL client rejected them, while some custom or embedded clients may not.
Affected Versions
- OpenSSL-compatible backend: GoAhead 3.4.5 through 6.1.0, with a CRL configured
- Mbed TLS backend: GoAhead 4.0.2 through 6.1.0, with TLS 1.2 DHE_RSA suites
- LibreSSL legacy verifier: GoAhead 6.1.0 and earlier, with issuer verification disabled
According to FoxIO, the Mbed TLS typo dates back to 2018.
Patch and Mitigation
Upgrade to GoAhead 6.1.1 or later. The v6.1.1 tag in the official GoAhead repository contains both the CRL check and the corrected DH buffer length. Device makers must then ship the fix in their own firmware.
If you cannot upgrade, FoxIO suggests these steps:
- Disable finite-field DHE cipher suites on Mbed TLS builds.
- Enable issuer verification with a trusted CA bundle on LibreSSL builds.
- Move to LibreSSL 4.x or OpenSSL for the depth issue.
FoxIO also shares JA4S and JA4Scan fingerprints to help teams spot affected servers. So far, no exploitation in the wild has been reported for these GoAhead TLS vulnerabilities, and no CVE IDs appear in the advisory.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
