CVE-2026-115884

A critical vulnerability in the GoAhead embedded web server causes revoked client certificates to remain valid on certain mutual TLS deployments.

Tracked as CVE-2026-115881, the flaw carries a CVSS score of 9.1 and affects GoAhead versions 3.4.5 through 6.1.0.

⠀

GoAhead loads the configured certificate revocation list but fails to enable the OpenSSL flag that actually enforces it. An attacker possessing a previously trusted certificate and its private key could continue accessing protected services after the certificate was revoked.

⠀

Researchers also disclosed two related TLS flaws:

• CVE-2026-115884: Certain LibreSSL builds may accept an overlong certificate chain, CVSS 7.4

• GOAHEAD-SA-2026-0005: Mbed TLS builds may use a one-byte Diffie-Hellman modulus, allowing some recorded TLS 1.2 sessions to be decrypted, CVSS 5.9

⠀

GoAhead is embedded in management interfaces for routers, printers, gateways and industrial equipment.

Exposure depends on the TLS library and configuration used by each device, so the widespread use of GoAhead does not mean every device is vulnerable.

⠀

All three flaws were fixed in GoAhead 6.1.1. Device owners may need to wait for firmware containing the update from their equipment manufacturer.

Source: https://github.com/embedthis/goahead/security/advisories/GHSA-5m75-xq69-c3c5