FoxIO disclosed three GoAhead TLS bugs that can let revoked certificates through or expose some encrypted sessions to eavesdroppers.

TL;DR FoxIO has published full details and proof-of-concept code for three GoAhead TLS vulnerabilities. The worst scores 9.1 on CVSS and lets revoked client certificates pass mutual TLS checks. GoAhead is an embedded web server that, according to FoxIO, runs in "hundreds of millions" of devices. Three separate bugs in GoAhead's TLS backends can accept revoked certificates, expose encrypted sessions or skip a chain-depth limit.

TL;DR FoxIO has published full details and proof-of-concept code for three GoAhead TLS vulnerabilities. The worst scores 9.1 on CVSS and lets revoked client certificates pass mutual TLS checks. GoAhead is an embedded web server that, according to FoxIO, runs in "hundreds of millions" of devices. Three separate bugs in GoAhead's TLS backends can accept revoked certificates, expose encrypted sessions or skip a chain-depth limit.

We solve the world’s toughest cyber challenges—creating breakthrough technology and embedding it into the systems that run everything.

FoxIO disclosed three TLS flaws in GoAhead that can undermine certificate revocation, expose some TLS 1.2 sessions to offline decryption, or bypass…

Introduction: Security researchers at FoxIO disclosed multiple security vulnerabilities in Embedthis GoAhead, an embedded web server deployed across hundreds of millions of networking appliances, smart printers, and industrial IoT devices. The flaws impact how GoAhead handles TLS certificate validation, certificate chain verification, and key exchange parameters. Unpatched configurations can allow revoked client certificates to authenticate, compromise encryption sessions, or bypass configured chain-depth restrictions.

We solve the world’s toughest cyber challenges—creating breakthrough technology and embedding it into the systems that run everything.

Introduction: Three TLS Flaws Could Weaken GoAhead's Security Protections Security researchers at FoxIO have disclosed three TLS-related vulnerabilities affecting GoAhead, an embedded web server used in device-management interfaces and other embedded systems. According to the initial report, the flaws can undermine certificate revocation checks, potentially expose certain TLS 1.2 sessions to offline decryption, or bypass certificate-chain length restrictions. The practical impact depends on the TLS library, implementation details, and configuration used by the affected deployment.

We solve the world’s toughest cyber challenges—creating breakthrough technology and embedding it into the systems that run everything.

We solve the world’s toughest cyber challenges—creating breakthrough technology and embedding it into the systems that run everything.

We solve the world’s toughest cyber challenges—creating breakthrough technology and embedding it into the systems that run everything.

We solve the world’s toughest cyber challenges—creating breakthrough technology and embedding it into the systems that run everything.

We solve the world’s toughest cyber challenges—creating breakthrough technology and embedding it into the systems that run everything.

We solve the world’s toughest cyber challenges—creating breakthrough technology and embedding it into the systems that run everything.

We solve the world’s toughest cyber challenges—creating breakthrough technology and embedding it into the systems that run everything.

We solve the world’s toughest cyber challenges—creating breakthrough technology and embedding it into the systems that run everything.

We solve the world’s toughest cyber challenges—creating breakthrough technology and embedding it into the systems that run everything.

We solve the world’s toughest cyber challenges—creating breakthrough technology and embedding it into the systems that run everything.

We solve the world’s toughest cyber challenges—creating breakthrough technology and embedding it into the systems that run everything.

We solve the world’s toughest cyber challenges—creating breakthrough technology and embedding it into the systems that run everything.

Last Updated: 2026-10-27T20:12:12Z (UTC) CVEs: CVE-2026-115881, n/a, CVE-2026-115884 CVSSv4: 9.1, 5.9, 7.4 What’s Happening On 2026-10-26T07:00:00Z (UTC), research firm FoxIO published a blog post concerning three vulnerabilities in the TLS implementation of the GoAhead embedded web server. This web server is commonly used in network appliances, including devices from Palo Alto Networks, D-Link, Siemens, and others. Three separate vulnerabilities are disclosed. The first and most severe, C...

We solve the world’s toughest cyber challenges—creating breakthrough technology and embedding it into the systems that run everything.

We solve the world’s toughest cyber challenges—creating breakthrough technology and embedding it into the systems that run everything.