Loading vulnerability…
Certificate-chain depth bypass in GoAhead with legacy LibreSSL
CVE-2026-115884 is a certificate-validation vulnerability affecting EmbedThis GoAhead through version 6.1.0 when built with the legacy verifier in LibreSSL 3.2.x or 3.3.2 through 3.3.6. When client certificates are required but issuer verification is disabled, LibreSSL reports an issuer error instead of a certificate-chain depth error, and GoAhead ignores that error under the configured policy. This permits certificate chains exceeding GoAhead's configured depth limit of 10 to complete the TLS handshake. Testing demonstrated acceptance of a 17-certificate chain rooted in a self-signed authority. The vendor-assigned severity score is 7.4.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker can bypass the certificate-chain depth restriction and complete client-certificate TLS authentication with an overlong chain, including one rooted in a self-signed authority. Access to application resources depends on subsequent authorization controls. The demonstrated failure concerns chain-depth enforcement; it does not establish arbitrary code execution or unrestricted administrative access.
If you can’t patch tonight, do this now.
Enable issuer verification and configure a trusted certificate-authority bundle instead of accepting client certificates from arbitrary issuers. Where immediate changes are unavailable, restrict access to the affected TLS service using network segmentation, firewall rules, or trusted administrative networks. Confirm that certificate chains exceeding the configured depth limit are rejected.
Patch, then assume compromise.
Replace the affected legacy LibreSSL backend with OpenSSL or LibreSSL 4.x, preferably through manufacturer-supported firmware. LibreSSL 4.3.1 was demonstrated to reject the oversized chain. Upgrade GoAhead to 6.1.1 or later where available, but verify the bundled TLS library and certificate-validation behavior rather than assuming a GoAhead-only upgrade removes the legacy-verifier exposure. Device manufacturers must incorporate the required changes into distributed firmware.
No public exploits tracked yet. Mallory keeps watching.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.