GoAhead Embedded Web Server Patched Following Certificate Revocation Security Flaws

Three security vulnerabilities have been identified in GoAhead, an embedded web server built into routers, printers, gateways, and industrial controllers. CyberSecurityNews reported that the flaws impact how devices verify digital certificates and secure encrypted communications. The underlying software is integrated into hundreds of millions of devices, including those manufactured by Palo Alto Networks, Siemens, Honeywell, and Boeing. [1]

The flaws stem from how the web server handles Transport Layer Security libraries and certificate revocation lists. According to The Hacker News, GoAhead loaded revocation lists into its default TLS backend but failed to enable active revocation checking. As a result, setups using OpenSSL mutual authentication would accept revoked client certificates even when an operator had configured a revocation list to block them. [1][2]

Maintainers have released GoAhead version 6.1.1 to fix the certificate revocation flaw. The vulnerability specifically affects builds that rely on the OpenSSL backend with mutual TLS enabled, where both the server and the client validate each other's credentials. System administrators using affected configurations are advised to update to the patched version. [2]

Separately, SecurityWeek reported that HPE released security updates to patch 72 vulnerabilities in the AOS-8 and AOS-10 wireless operating systems of its Aruba networking products. The updates address 33 critical flaws, including eight maximum severity bugs tracked from CVE-2026-79844 through CVE-2026-79851. These vulnerabilities could allow unauthenticated attackers to execute remote code or bypass authentication on targeted systems. [4]