GoAhead嵌入式Web服务器曝出三个TLS漏洞，6.1.1版本已修复

安全研究人员Sébastien Féry披露了嵌入式Web服务器GoAhead中存在的三个独立TLS集成漏洞，这些缺陷影响数亿台物联网设备、防火墙及工业控制系统 1。受影响的版本包括3.4.5至6.1.0（涉及OpenSSL CRL缺陷）、4.0.2至6.1.0（涉及Mbed TLS DH缺陷）以及特定配置下的LibreSSL缺陷 1。相关安全公告标识为GOAHEAD-SA-2026-0006 (CVE-2026-115881)、GOAHEAD-SA-2026-0004 (CVE-2026-115884) 和 GOAHEAD-SA-2026-0005 1。

在技术细节方面，OpenSSL后端虽然加载了证书吊销列表（CRL），但未设置X509_V_FLAG_CRL_CHECK标志，导致吊销证书未被强制检查，该漏洞CVSS评分高达9.1（严重级别）1。Mbed TLS后端将DH模数长度错误地设置为生成器缓冲区的字节数（即1字节而非预期的256字节），这种参数截断使得会话可被解密，其CVSS评分为5.9（中等风险）1。此外，LibreSSL旧版验证器在禁用Issuer检查时容忍过深链的错误代码20，从而允许绕过链深度限制，该问题CVSS评分为7.4（高风险）1。GoAhead Web Server开发者已于2026年8月2日发布版本6.1.1以修复上述所有安全问题 1。

Security researcher Sébastien Féry has disclosed three distinct vulnerabilities in the integration of Transport Layer Security (TLS) within the GoAhead embedded web server, affecting hundreds of millions of IoT devices, firewalls, and industrial systems 1. The flaws, reported on October 26, 2026, stem from improper certificate validation and parameter handling across different cryptographic backends including OpenSSL, LibreSSL, and Mbed TLS 1.

The most severe issue involves the OpenSSL backend, where Certificate Revocation Lists (CRLs) are loaded but the necessary X509_V_FLAG_CRL_CHECK flag is not set, resulting in revoked certificates being accepted; this flaw carries a CVSS score of 9.1 (Critical) and affects versions 3.4.5 through 6.1.0 1. A high-severity vulnerability (CVSS 7.4) exists in older LibreSSL validators, allowing attackers to bypass chain depth limits when Issuer checks are disabled due to tolerance for error code 20 1. Additionally, a medium-severity flaw (CVSS 5.9) in the Mbed TLS backend permits session decryption because the Diffie-Hellman modulus length is incorrectly truncated to one byte instead of 256 bytes 1. This specific Mbed TLS defect affects versions 4.0.2 through 6.1.0 1.

FoxIO LLC, the developer behind GoAhead, released version 6.1.1 on August 2, 2026, to patch these security gaps 1. The updates address defects tracked under security advisories GOAHEAD-SA-2026-0006 (CVE-2026-115881), GOAHEAD-SA-2026-0004 (CVE-2026-115884), and GOAHEAD-SA-2026-0005 1.