early signals oss-security infra

Three TLS Bugs in GoAhead web server prior to 6.1.1

// AI summary

GoAhead web server prior to 6.1.1 contains three TLS bugs affecting OpenSSL, LibreSSL, and Mbed TLS backends, which are disclosed in the code.

// from the source

Posted by Alan Coopersmith on Oct 27 EmbedThis GoAhead is an embeddable web server available under GPL or commercial license (see https://github.com/embedthis/goahead ). It can be compiled against a choice of TLS backends. https://foxio.io/blog/choose-your-backend-three-tls-bugs-in-goahead discloses vulnerabilities in the GoAhead code for three of those backends: OpenSSL, LibreSSL, and Mbed TLS. The TLDR section on that page says: The web page then goes into much further detail...
Read at seclists.org ↗ More from oss-security

# more from oss-security

  1. oss-security infra

    CPython [CVE-2026-116566] socket.getaddrinfo() accepts embedded null bytes in host and port

    seclists.org
  2. oss-security

    CVE-2025-60482: GPAC/MP4Box: Heap Use-After-Free in AC-4 Descriptor Cleanup

    seclists.org
  3. oss-security infra

    [OSSA-2026-050] OpenStack keystonemiddleware: access_rules bypass via X-Service-Token (CVE-2026-115642)

    seclists.org
  4. oss-security infra

    [OSSA-2026-049] Ironic: Conductor DoS via gzip bomb configdrive (CVE-2026-115638)

    seclists.org
  5. oss-security infra

    CVE-2026-115942: Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read

    seclists.org