GoAhead TLS flaw lets revoked client certificates pass and sessions be decrypted

The GoAhead embedded web server loads a certificate revocation list into its default OpenSSL TLS backend but never enables revocation checking, so a revoked client certificate can still authenticate under mutual-TLS. The flaw affects builds with a configured CRL and enables session decryption.

• GoAhead loads a CRL but never turns on revocation checking
• Affected builds use the OpenSSL backend with mutual-TLS
• A revoked client certificate can still pass login