GoAhead TLS bug shrinks 2048-bit DH prime to 255, leaving 8 secrets

FoxIO disclosed three TLS flaws in GoAhead; the main one (GOAHEAD-SA-2026-0005, CVSS 5.9) passes the generator's length for the 2048-bit prime, truncating the modulus to 255 and leaving just 3 bits of entropy. The typo dates to 2018 and affects GoAhead 4.0.2–6.1.0 on the Mbed TLS backend; it is fixed in 6.1.1.

• mbedtls_ssl_conf_dh_param_bin passes g's length instead of p's, yielding modulus 255
• Shared secret has only 8 possible values; brute force averages 4.35 attempts
• Affects GoAhead 4.0.2–6.1.0 on Mbed TLS with TLS 1.2 DHE_RSA suites
• Fixed in GoAhead 6.1.1 (Aug 2); CRL checking flaw rated CVSS 9.1