GoAhead web server: TLS bugs

GoAhead web server

Three TLS bugs found in GoAhead web server prior to 6.1.1, affecting OpenSSL, LibreSSL, and Mbed TLS backends.

Do this now

Upgrade GoAhead web server to 6.1.1 or later, since all versions before 6.1.1 carry the three TLS bugs.

Fix it

Upgrade to GoAhead web server 6.1.1

First seen: 28 Oct 2026
Last update: 28 Oct 2026, 01:18 UTC
Fixed in: 6.1.1
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## GoAhead web server: TLS bugs
Severity: unknown. Patch status: patched.
Affected: GoAhead web server
Fixed in: 6.1.1

Three TLS bugs found in GoAhead web server prior to 6.1.1, affecting OpenSSL, LibreSSL, and Mbed TLS backends.

## Steps
1. Search the repo, its CI and infra config for GoAhead web server. If present, report the version in use and whether it's affected.
2. Fix by release line: GoAhead web server: 6.1.1.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| GoAhead web server | fixed | 6.1.1 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://seclists.org/oss-sec/2026/q4/408
https://pwned.coffee/i/goahead-web-server-tls-bugs

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
GoAhead web server before 6.1.1 6.1.1 Reported checked 28 Oct
Score: No CVSS published yet: severity unknown.
Last checked: 28 Oct 2026, 02:19 UTC

Product	Affected	Fixed in	Source
GoAhead web server	before 6.1.1	6.1.1	Reported checked 28 Oct

Sources: KEV – CVE record – Vendor –

Sources

seclists.org: Three TLS Bugs in GoAhead web server prior to 6.1.1

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone coffee