X41 D-Sec

Security Audit of NLnet Labs Routinator X41 performed a source code audit of NLnet Labs Routinator , commissioned by the Sovereign Tech Agency . It is a Relying Party software for Resource Public Key Infrastructure (RPKI). At a functional level, Routinato

X41 D-Sec GmbH Security Advisory: X41-2026-002 Request Host Header not Validated in Starlette Severity Rating: High Confirmed Affected Versions: starlette = 0.8.3, 1.0.1 Confirmed Patched Versions: starlette 1.0.1 Vendor: Starlette Vendor URL: https://git

Review of SecureDrop Workstation X41 performed a white-box penetration test against SecureDrop Workstation , which is used to connect to the SecureDrop whistleblower submission system. The system was originally coded by Aaron Swartz and is now managed by

X41 D-Sec GmbH Security Advisory: X41-2026-001 Guardrail Sandbox Escape in LiteLLM Severity Rating: High Confirmed Affected Versions: main-latest (docker image ghcr.io/berriai/litellm:main-latest , repo digest ghcr.io/berriai/litellm@sha256:bb063970179621

Review of AzireVPN and Malwarebytes Privacy VPN X41 performed a white box penetration test against the AzireVPN framework, which is used to power the Malwarebytes Privacy VPN service. The full report can be found here: https://www.x41-dsec.de/static/repor

Review of Mullvad VPN API X41 performed a white box penetration test with source code access against Mullvad VPN AB's public API and connected services. In 2024, X41 already conducted an audit of the client applications . After good feedback from Mullvad

Security Audit of CRI-O Runtime X41 performed a source code audit of CRI-O , the Open Container Initiative-based implementation of the Kubernetes Container Runtime Interface, sponsored and organized once again by the Open Source Technology Improvement Fun

Happy Holidays Again, the year is racing to its end. Whatever you are planning for the next few weeks, X41 wishes you a lot of fun! We performed several audits for OSTIF this year, among them for open source projects such as Hickory DNS , RSTUF , a hre...

Java Fingerprinting We gave BeanStack a huge update, to make sure you can still reliably fingerprint Java stack traces. In pentests against Java web-applications, stack traces are found quite often and reveal that an error happened in the web-application.

Is Mouse Input Random Enough for Generating Secret Keys? Introduction Previous Work Prior Software Implementations Method Results Positions Timings Statistical Sof...