GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption

The GoAhead embedded web server loaded a certificate revocation list into its default TLS backend but never enabled revocation checking, so a revoked client certificate could still pass authentication on affected mutual-TLS setups, according to FoxIO research published October 26. The main flaw, CVE-2026-115881, is rated 9.1 and affects GoAhead 3.4.5 through 6.1.0; two further TLS problems can allow an over-long certificate chain or let a passive observer decrypt a session, and EmbedThis fixed all three in GoAhead 6.1.1, which device makers must ship as firmware updates.