The facts

  1. CVE-2026-115881 affects GoAhead 3.4.5–6.1.0 using an OpenSSL-compatible backend with mutual TLS and a configured certificate revocation list. Revoked client certificates may still be accepted. The vendor lists 6.1.1 as the patched version. [2][5]

  2. Advisory GHSA-fmvx-2xfx-2gq4 covers GoAhead 4.0.2–6.1.0 using Mbed TLS. Some TLS 1.2 sessions can be decrypted if the client accepts invalid encryption parameters. The vendor lists 6.1.1 as patched; OpenSSL builds are not affected by this particular defect. [3]

  3. CVE-2026-115884 affects GoAhead through 6.1.0 with the legacy verifier in LibreSSL 3.2.x or 3.3.2–3.3.6, when client certificates are required but issuer verification is disabled. The vendor lists 6.1.1 as patched. This specific bypass does not affect ordinary OpenSSL builds. [4]

  4. FoxIO also recommends enabling trusted-issuer verification or using a supported alternative TLS backend for the LibreSSL configuration. An upstream GoAhead fix does not establish that every device manufacturer has distributed updated firmware. [1][5]

Relevant context

The vendor advisories were published on 12 October; the fuller FoxIO analysis appeared on 26 October and independent specialist coverage followed on 28 October. The vulnerabilities are not newly discovered on this article's publication date. [1][2][3][4][5]

Still unconfirmed

  • The checked sources do not establish the number of deployed devices using vulnerable configurations, manufacturer-by-manufacturer firmware availability, or confirmed exploitation in the wild. Broad GoAhead installation estimates are not counts of vulnerable devices.

Sources

References support the numbered facts above. Source checks: 28 Oct 2026, 22:41 UTC.

  1. Choose Your Backend: Three TLS Bugs in GoAhead

    FoxIO · Primary source · 26 Oct 2026

    Original research by Sébastien Féry, including configuration-specific impact and mitigations. Research demonstration is not evidence of exploitation in the wild.

  2. GHSA-5m75-xq69-c3c5: OpenSSL certificate revocation checking disabled

    EmbedThis GoAhead · Primary source · 12 Oct 2026

    Vendor advisory for CVE-2026-115881; affected and patched versions checked directly.

  3. GHSA-fmvx-2xfx-2gq4: MbedTLS parameter truncation

    EmbedThis GoAhead · Primary source · 12 Oct 2026

    Vendor advisory for the separate Mbed TLS issue. No CVE number is asserted for it.

  4. GHSA-r392-vqwx-3r4g: LibreSSL legacy-verifier certificate-chain bypass

    EmbedThis GoAhead · Primary source · 12 Oct 2026

    Vendor advisory for CVE-2026-115884. The vendor's patched-version field and the researcher's additional configuration mitigations are distinguished.

  5. TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices

    SecurityWeek · Reporting · 28 Oct 2026

    Independent specialist reporting by Eduard Kovacs. It reports the FoxIO findings and manufacturer-update limitation, rather than an independently counted vulnerable-device total.

Report a factual error