Choose Your Back End: Three TLS Bugs in GoAhead
Comments on “Choose Your Back End: Three TLS Bugs in GoAhead”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
FoxIO disclosed three TLS integration bugs in GoAhead, an embedded web server for routers, printers and industrial devices, fixed in 6.1.1. The OpenSSL backend loads a configured CRL but never enforces it, so revoked client certificates pass mTLS (CVSS 9.1). A length typo in the Mbed TLS backend shrinks the DH modulus to one byte, exposing TLS 1.2 DHE sessions to permissive clients (5.9). Legacy LibreSSL builds with issuer checking off accept over-depth chains (7.4). Deployment figures and some version details were not independently verified.
Why it ranked
No. 12 of 155 with a score of 0.69. The panel rated it highest on technical depth (0.93) and new information (0.93), lowest on audience breadth (0.46).
- AI judgeJudge 2claude-haiku-5-5
- Detailed, reproducible security analysis of three TLS bugs in GoAhead with PoC and fingerprints; highly substantiated and technical, though affecting a niche embedded-server audience and not previously covered in the listed stories.
- AI judgeJudge 3gpt-5.6-luna
- Detailed, reproducible vulnerability analysis with PoC evidence, affected configurations, exploitation conditions, fingerprints, mitigations, and references. It is highly actionable for embedded, security, infrastructure, and device-management practitioners.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.69total under rubric v2.2
- Significance0.60
- Reader interest0.76
- Audience breadth0.46
- Practical relevance0.78
- Substantiated0.91
- Technical depth0.93
- New information0.93
- Counts against: Promotional0.04
- Counts against: Overclaim0.14
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.61 | 0.40 | 0.78 | 0.60 | 0.38 | +0.24 | +0.144 |
| Reader interest | 0.74 | 0.60 | 0.94 | 0.76 | 0.34 | +0.26 | +0.198 |
| Audience breadth | 0.41 | 0.35 | 0.62 | 0.46 | 0.27 | +0.13 | +0.060 |
| Practical relevance | 0.89 | 0.60 | 0.86 | 0.78 | 0.29 | +0.22 | +0.172 |
| Substantiated | 0.95 | 0.85 | 0.94 | 0.91 | 0.10 | +0.05 | +0.046 |
| Technical depth | 1.00 | 0.85 | 0.95 | 0.93 | 0.15 | +0.05 | +0.047 |
| New information | 0.91 | 0.90 | 0.98 | 0.93 | 0.08 | +0.05 | +0.047 |
| Promotional | 0.04 | 0.05 | 0.02 | 0.04 | 0.03 | −0.19 | −0.007 |
| Overclaim | 0.12 | 0.20 | 0.10 | 0.14 | 0.10 | −0.11 | −0.015 |
| Sum of contributions | +0.689 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.689 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-28/12/"><img src="https://rubric.hrih.si/badge/2026-10-28/12.svg" alt="Ranked #12 on Rubric, 28 Oct 2026" width="245" height="28"></a>Claim check
Claim check: 3 matches source · 3 no source given · 2 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Matches sourceCausal conclusion
GoAhead's OpenSSL-compatible backend loads the configured CRL but never enables revocation checking, so revoked client certificates are accepted (CVSS 9.1, GOAHEAD-SA-2026-0006).
The cited source says the same thing.
The article says “GoAhead's OpenSSL backend loads the configured CRL into the certificate store but never enables revocation checking”
The source says “GoAhead's OpenSSL TLS backend loads a configured Certificate Revocation List (ME_GOAHEAD_SSL_REVOKE) into the OpenSSL certificate store but does not call X509_STORE_set_flags(store, X509_V_FLAG_CRL_CHECK”
Source cited by the article: github.com/embedthis/goahead/security/advisories/GHSA-5m75-xq69-c3c5
Matches sourceCausal conclusion
A buffer-length typo in GoAhead's Mbed TLS backend reduces a 2048-bit DH modulus to one byte, making TLS 1.2 DHE_RSA sessions decryptable when the client accepts the parameters (CVSS 5.9).
The cited source says the same thing.
The article says “A buffer-length typo reduces a 2048-bit DH modulus to one byte”
The source says “A passive observer who captures a completed DHE handshake against a permissive client can recover the server's DH exponent in single-digit iterations”
Source cited by the article: github.com/embedthis/goahead/security/advisories/GHSA-fmvx-2xfx-2gq4
Matches sourceCausal conclusion
On GoAhead 6.1.0 linked against LibreSSL 3.3.6 with the legacy verifier and VERIFY_ISSUER=0, an over-depth client chain is accepted, bypassing the chain-depth limit (CVSS 7.4).
The cited source says the same thing.
The article says “An over-depth client chain is accepted when client certificates are required but issuer checking is disabled”
The source says “An attacker who can reach an mTLS-protected HTTPS endpoint, on an affected LibreSSL-linked build, can present a self-signed certificate chain longer than the server's configured VERIFY_DEPTH (10) and complete the…”
Source cited by the article: github.com/embedthis/goahead/security/advisories/GHSA-r392-vqwx-3r4g
No source givenNumber
GoAhead is deployed in hundreds of millions of devices, including those from Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens and others.
The article gives no link or citation for it.
The article says “GoAhead is used in hundreds of millions of IoT, Firewall, OT, and Military devices”
The source says No source to compare with.
Couldn’t checkVersion
GoAhead 6.1.1 fixes these bugs; the OpenSSL CRL defect affects versions 3.4.5 through 6.1.0.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Affected: GoAhead 3.4.5 through 6.1.0 using the OpenSSL-compatible backend with a CRL configured”
The source says No passage could be compared.
Source cited by the article: github.com/embedthis/goahead/security/advisories/GHSA-5m75-xq69-c3c5
No source givenDate
The Mbed TLS DH typo entered in 2018 during migration to the binary-parameter API and survived the April 2024 TLS refactor.
The article gives no link or citation for it.
The article says “The typo entered in 2018 during migration to the binary-parameter API and survived the April 2024 TLS refactor”
The source says No source to compare with.
Couldn’t checkNumber
The author reproduced the shared secret after five attempts in the PoC, matching the client's secret and enabling decryption of the HTTP exchange.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “In the attached PoC, I managed to reproduce the shared secret after five attempts”
The source says No passage could be compared.
Source cited by the article: github.com/FoxIO-LLC/blog_poc/tree/main/chooseyourbackend
No source givenBenchmark result
The same GoAhead source built against LibreSSL 4.3.1 received error 22 at depth 10 and rejected the 17-certificate chain, while LibreSSL 3.3.6 returned HTTP 200.
The article gives no link or citation for it.
The article says “The same GoAhead source built against LibreSSL 4.3.1 received error 22 at depth 10 and rejected the chain”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 2 pts, front page
Recorded for context only, checked 28 Oct 2026, 06:47 UTC. It played no part in the ranking.