GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption

GoAhead embedded web server versions using OpenSSL with mutual-TLS fail to enforce certificate revocation, allowing revoked client certificates to authenticate and enabling session decryption. The issue affects deliberate configurations with revocation lists but not default builds or Mbed TLS backend. GoAhead 6.1.1, released August 2, 2026, fixes the flaw.