Skip to content
Vulnerabilities in GoAhead Web Server
- Who
- All organizations and individuals using GoAhead Web Server.
- Action
- Apply the updates provided by the vendor.
What changed
Multiple vulnerabilities exist in GoAhead Web Server due to improper certificate validation. These flaws allow a remote attacker to bypass security restrictions and obtain sensitive information. An attacker can also decrypt certain TLS-encrypted communications or gain unauthorized access to affected services. The vulnerabilities affect GoAhead Web Server versions 3.4.5 to 6.1.0 with OpenSSL TLS build, versions 4.0.2 to 6.1.0 with Mbed TLS build, and versions 6.1.0 and prior with LibreSSL Legacy TLS build. All organizations and individuals using the affected software must apply the updates provided by the vendor.
What you must do
- Apply the updates provided by the vendor.
Key dates
- Original Issue Date
- 28 Oct 2026
Document text
CERT-In Advisory CIAD-2026-0057
Multiple vulnerabilities in GoAhead Web Server
Original Issue Date: October 28, 2026
Severity Rating: Critical
Software Affected
GoAhead Web Server versions 3.4.5 to 6.1.0 with OpenSSL TLS build GoAhead Web Server versions 4.0.2 to 6.1.0 with Mbed TLS build GoAhead Web Server versions 6.1.0 and prior with LibreSSL Legacy TLS build
Overview
Multiple vulnerabilities have been reported in GoAhead Web Server which could allow a remote attacker to bypass security restrictions, obtain sensitive information, decrypt certain TLS-encrypted communications, or unauthorized access to affected services on the targeted system.
Target Audience:
All organizations and Individuals using GoAhead Web Server.
Risk Assessment:
High risk of bypassing security restrictions and obtaining sensitive information.
Impact Assessment:
Potential for unauthorized access, disclosure of sensitive information, and compromise of affected systems.
Description
GoAhead is an embedded web server used for device management in various IoT, firewall, and industrial control devices.
These vulnerabilities exist in GoAhead due to improper certificate validation.
Successful exploitation of these vulnerabilities could allow an attacker to bypass security restrictions, obtain sensitive information, decrypt certain TLS-encrypted communications, or unauthorized access to affected services on the targeted system.
Solution
Apply appropriate updates as mentioned by the vendor: https://www.embedthis.com/goahead/
Vendor Information
EmbedThis (GoAhead) https://www.embedthis.com/goahead/
References
https://foxio.io/blog/introducing-ja4scan-active-server-fingerprinting-for-tls-and-quic https://github.com/embedthis/goahead/security/advisories/GHSA-5m75-xq69-c3c5 https://github.com/embedthis/goahead/security/advisories/GHSA-r392-vqwx-3r4g https://github.com/embedthis/goahead/security/advisories/GHSA-fmvx-2xfx-2gq4
CVE Name
CVE-2026-115881 CVE-2026-115884
Source details
- Official title
- CIAD-2026-0057 : Multiple vulnerabilities in GoAhead Web Server
- Source
- Indian Computer Emergency Response Team
- Type
- advisory
- Published by source
- 28 Oct 2026
- Document number
- CIAD-2026-0057
- Issuing division
- CERT-In
- Coverage area
- cybersecurity