Skip to content

v6.1.1

Latest
Latest

Choose a tag to compare

View all tags
@dev-embedthis dev-embedthis released this 12 Oct 04:31
· 41 commits to main since this release
v6.1.1
59ec3fe

GoAhead v6.1.1 Release Notes

Release Date: August 2, 2026 (device builders); advisories published October 12, 2026

Overview

GoAhead v6.1.1 is a security patch release. It closes an authentication bypass, TLS and mTLS certificate-validation defects, CGI argument- and environment-injection defects, several HTTP request-smuggling vectors, and the findings of an in-house multi-specialist source audit. With this release no Critical or High finding remains open. Upgrading is recommended for all deployments.

What's New

Security Audit

The most significant change in this release is the outcome of a full in-house security audit of the source tree:

  • Eleven Advisories: Eleven GoAhead security advisories are resolved in this release (see Security Advisories below)
  • Audit Fixes: A further 31 internally found defects are fixed, grouped below by class
  • Regression Coverage: Every fix carries a regression test
  • Release Gates: Security gates now run in CI on every push and pull request

Security Enhancements

  • Authentication & Sessions:

    • Session id is rotated at every privilege transition: form, Basic and Digest login
    • Clients can no longer seed a new session with their own cookie value
    • Digest nonce no longer carries the server secret on the wire
    • Plaintext password limit (32 characters) is now independent of username and realm length
    • BF1 stored hashes combined with Digest authentication are rejected explicitly
    • A build with ME_GOAHEAD_AUTH=0 now refuses to start with a route table that requires authentication, rather than serving protected routes unauthenticated
    • Startup warnings when no route requires authentication, or when an unauthenticated route shadows an authenticated one

  • HTTP Protocol Hardening:

    • Strict RFC 9112 request framing: Content-Length with Transfer-Encoding rejected, unsupported transfer codings rejected, Content-Length parsed strictly at 64-bit width
    • Per-peer connection limit and an absolute deadline on the pre-header phase to bound Slowloris attacks
    • Blocking response flush is bounded by a deadline so a slow reader cannot freeze the server indefinitely
    • Only regular files are served; FIFOs and Windows device names are refused
    • Authentication challenges and error responses are no longer marked publicly cacheable

  • CGI Hardening:

    • ISINDEX query terms can no longer inject command-line options into the CGI program
    • HTTP_PROXY (httpoxy) filtered, and the CGI environment blacklist repaired
    • Request data is staged outside the served tree under unguessable names
    • CGI response headers are tokenized and sanitized; CGI-declared Content-Length is enforced

  • Code Hardening:

    • %n removed from the internal sprintf implementation
    • printf-family wrappers carry format attributes; builds ratcheted to -Wformat=2, with equivalent MSVC diagnostics

Fixed Issues

Security Fixes

  • Advisory Fixes:

    • Critical: Basic-auth password bypass for users with Blowfish (BF1:) stored hashes: any password authenticated the user (GOAHEAD-SA-2026-0001)
    • Critical: Windows CGI command injection: .bat CGI scripts ran through cmd.exe with request data on the command line (GOAHEAD-SA-2026-0007)
    • Critical: OpenSSL CRL checking was never enabled, so revoked mTLS client certificates were accepted (GOAHEAD-SA-2026-0006)
    • High: mTLS client-certificate chain-depth guard skipped on some LibreSSL releases, accepting over-depth chains with VERIFY_ISSUER=0 (GOAHEAD-SA-2026-0004)
    • High: CGI HTTP_PROXY injection and an inert CGI environment blacklist (GOAHEAD-SA-2026-0003)
    • High (conditional): CGI ISINDEX argument and option injection, including an encoded = bypass (GOAHEAD-SA-2026-0009)
    • Medium: Digest nonce exposed the server master secret (GOAHEAD-SA-2026-0002)
    • Medium: MbedTLS DHE sent a 1-byte DH modulus, destroying forward secrecy (GOAHEAD-SA-2026-0005)
    • Medium: HTTP request smuggling via Content-Length / Transfer-Encoding desync (GOAHEAD-SA-2026-0008)
    • Medium: HTTP request smuggling via an undrained HEAD body and a chunk-size integer wrap; cumulative chunked body now bounded (GOAHEAD-SA-2026-0010)
    • Low: Session fixation; session id not rotated on login (GOAHEAD-SA-2026-0011)

  • Authorization and Routing:

    • Critical: Case-variant, Unicode-normalization and Windows filename-folding URIs bypassed route authorization on case-insensitive file systems
    • Critical: A handler could run after the authentication gate had already returned 401
    • Critical: Unbounded re-route loop wedged the server

  • Memory Safety:

    • Critical: Use-after-free of a request freed by timeout while its CGI child was registered
    • Critical: Use-after-free of a session freed by a concurrent logout or prune
    • Critical: Double free when the PUT staging file could not be opened
    • Critical: Repeated upload filename= parameters leaked file descriptors and temp files
    • High: Pre-authentication out-of-bounds read in the Digest Authorization parser
    • High: Heap use-after-free in the JST interpreter
    • High: Memory leak per failed Digest authentication, and per Set-Cookie (including unauthenticated logout)

  • Format Strings:

    • Critical: CGI Content-Type value used as a printf format string
    • Critical: %n conversion supported by the internal formatter
    • High: Missing format attributes hid format-string defects from the compiler

  • Availability:

    • Critical: Slow-reading client could freeze the event loop indefinitely
    • Critical: Request naming a FIFO or device blocked the server
    • High: No concurrent-connection limit made Slowloris a whole-server denial of service
    • Medium: Failed form logins exhausted the session table
    • Medium: Leading blank lines before the request line were unbounded

  • CGI:

    • Critical: Chunked and body-less requests published CONTENT_LENGTH=-1 to CGI programs
    • High: CGI header pass-through bypassed the header-key sanitizer
    • High: Headerless CGI output corrupted the response header block
    • High: CGI-declared Content-Length not enforced against bytes written
    • High: 408 timeout response never sent for a detached CGI
    • Medium: CGI control headers dropped after a pass-through header

  • HTTP Framing:

    • Medium: Request smuggling via Content-Length integer overflow
    • Medium: Response Content-Length truncated for files of 2 GiB or more

Platform-Specific Fixes

  • Windows:

    • Fixed CGI handle lifecycle (invalid handle closed, uninitialised thread handle)
    • Fixed websReadWholeFile leaving heap data after file contents
    • Restored the Windows build script; added make.bat for Visual Studio 2022

  • VxWorks:

    • High: No-fork CGI freed argv storage while the spawned task was still reading it
    • High: CGI temp files created in the document root under predictable names

  • Linux:

    • Fixed PIE/PIC link conflict

Protocol & Functionality Fixes

  • Local host address resolved with getaddrinfo, with a fallback when the hostname does not resolve
  • Command-line options missing their value are rejected
  • Startup diagnostics written to stderr
  • PAM group buffer freed on every authentication
  • Access-log format corrected for request sizes

Improvements

Build System

  • Build projects generated from premake5: GNU Make, Visual Studio 2022 and Xcode
  • Reproducible source distribution with normalised archive metadata
  • Release archives published with SHA-256 checksums
  • Removed the unused updater module and obsolete project files

Code Quality

  • Source reformatted to the project style
  • Stale comments and dead code removed
  • Compiler format-string diagnostics enabled on all toolchains

Documentation

  • User information, Declaration of Conformity and SBOM shipped in the archive's doc/ directory
  • Conformity documentation (risk assessment, traceability, test report) maintained per release

Development Infrastructure

  • CI runs the full suite on Linux, macOS and Windows, plus static analysis (scan-build)
  • CI verifies the committed dist/ amalgamation matches src/
  • Test dependencies consumed from published npm packages

Compatibility

Breaking Changes

  • Windows: .bat and .cmd CGI scripts are no longer executed; requests for them receive 404. Wrap batch logic in a small .exe program.
  • BF1 hashes created by calling websMakePassword() directly on raw plaintext, bypassing gopass, no longer verify and must be regenerated with gopass.

Behavior Changes

  • Requests with both Content-Length and Transfer-Encoding, or Transfer-Encoding on HTTP/1.0, receive 400
  • Unsupported transfer codings receive 501 instead of being treated as Content-Length framed
  • On Windows, requests for .bat or .cmd CGI scripts receive 404
  • ISINDEX query terms beginning with - or containing a decoded = receive 400
  • gopass rejects a plaintext password longer than 32 characters with exit code 3
  • Pre-login session variables do not survive login
  • A build with ME_GOAHEAD_AUTH=0 refuses a route table that requires authentication

Deprecations

None.

Platform Support

  • Linux: x86_64 (CI-tested), ARM
  • macOS: Intel, Apple Silicon (CI-tested)
  • Windows: Windows 10+, Visual Studio 2022+ (CI-tested)
  • Embedded: VxWorks (supported via the osdep layer, not CI-tested)

Dependencies

  • OpenSSL (preferred) or MbedTLS. GoAhead does not pin a TLS library version; the integrator selects and maintains it
  • Standard C compiler (GCC, Clang, MSVC)
  • GNU Make, Visual Studio or Xcode
  • TestMe, Bun and npm for running unit tests

Migration Guide

Upgrading from 6.1.0

Drop-in replacement for 6.1.0. Rebuild and redeploy.

Configuration Changes

No configuration file changes required. Review startup warnings about unauthenticated routes.

Post-Upgrade Actions

  • Invalidate active sessions, or restart the server, to discard any pre-upgrade session id
  • Rotating BF1 user passwords is recommended

API Changes

  • Added websRotateSession(). All existing APIs remain compatible.

Known Issues

  • 174 Medium and Low findings remain open and are risk-accepted for this release. None is a disclosure, remote-code-execution or authentication-bypass path in a default build.
  • A slow-reading client can still hold the single-threaded event loop for up to ME_GOAHEAD_LIMIT_TIMEOUT (60 seconds by default) before it is dropped.
  • JST templates have no execution budget, and GoAhead provides no privilege-drop mechanism.

These limitations are described under Known Limitations in the user information shipped with the release.

Security Advisories

This release resolves the following GoAhead security advisories:

CVE identifiers have been requested and will be added to the advisories as they are assigned.

Operators running Basic authentication with BF1 users, mTLS, CGI (especially Windows .bat CGI), or GoAhead behind a proxy, load balancer or WAF should upgrade as a priority.

Testing

All unit tests pass: 86/86 tests, 12249/12249 assertions. The suite runs in CI on:

  • Linux (x86_64)
  • macOS (Apple Silicon)
  • Windows (x64)

The suite grew from 39 tests / 757 assertions, with new regression coverage for every security fix.

Acknowledgments

Thanks to the Embedthis team for the security audit, and to the researchers who reported issues under coordinated disclosure: Anushka Virgaonkar, Jérémy Luyé-tanet (Synacktiv), Vito Rallo, Sébastien Féry, Alejandro Ramos, Thurein Oo, Xinyao Hu, BUG|PWN Research and Sadoc ADONON, and NVIDIA Project Vanessa.

Getting the Release

Source Code

Verify the archive against the published SHA256SUMS.

Binary Packages

Binary packages are available for download from the Embedthis website:

Support

Commercial Support

Commercial support and licenses are available from:

Community Support

Security Issues

Please report security issues to: security@embedthis.com

What's Next

GoAhead is in maintenance mode. Future releases will focus on:

  • Security updates (active)
  • Remaining Medium and Low audit findings
  • Critical bug fixes (as needed)
  • Platform compatibility updates (as needed)

For new projects, consider the Ioto Device Agent, which provides modern IoT device management capabilities.

Commit Statistics

  • 129 commits since v6.1.0
  • Contributors: Embedthis development team
  • Files changed: 460
  • Focus areas: Fixes (40%), Build and CI (26%), Development (14%), Testing (11%), Documentation (9%)

Full Changelog: v6.1.0...v6.1.1

Assets 2
Loading