2026-07-26T16:10:02Z https://nostr.ae X41 D-Sec GmbH https://nostr.ae/npub1a7knlj2daku4ka2rtfs2hlj8tp42yrgg0gp9d3v5ftngwkma03zqvnguxz https://media.infosec.exchange/infosec.exchange/accounts/avatars/111/773/270/792/541/198/original/c978edfd2c13fd08.png https://media.infosec.exchange/infosec.exchange/accounts/avatars/111/773/270/792/541/198/original/c978edfd2c13fd08.png https://nostr.ae/nevent1qqsp3z6v7dmfhv2r7kpfpqunmzlf3ffqd9qr96zgu7gsl4dsamkktfgzyrh6607ffhkmjkm4gddxp2l7gavx4gsdppaqy4k9j39wdp6m047ygdk0pws There&#39;s an update for the Starlette issue: We&#39;ve scanned thousands of hosts for CVE-2026-48710 and found something important: Being behind a proxy or CloudFlare isn&#39;t always a protection unlike previously stated!<br/>When a reverse proxy or CDN (including Cloudflare) sits in front of the target and rejects malformed Host headers, the X-Forwarded-Host header can sometimes be used to bypass the protection! If the backend middleware reads X-Forwarded-Host and updates the ASGI scope, the malicious value can reach the ASGI and Starlette. #badhost 2026-05-28T07:30:41Z https://nostr.ae/nevent1qqsy5z9qf8gt24kwp8nvanq9xy6r7wcd6afmc8q477d4r5uf6dee9hszyrh6607ffhkmjkm4gddxp2l7gavx4gsdppaqy4k9j39wdp6m047ygc966vz After auditing the <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1xh7cv0xku4rqrp0yay046zw2y0wwl0mguzguq49zv2lye4a69zrs45v9hj" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Mullvad VPN</span> (<span class="italic">npub1xh7…v9hj</span>)</a></span> client applications in 2024, we have recently audited Mullvad VPN&#39;s API.<br/>The API is used by clients, partners, and internal services to manage user accounts and parts of the VPN infrastructure.<br/>Five issues were identified, of which only one had a very limited impact on users of the service.<br/><br/>The technical details may be found in our report. <a href="https://www.x41-dsec.de/security/research/news/2026/01/20/mullvad/">https://www.x41-dsec.de/security/research/news/2026/01/20/mullvad/</a> 2026-01-21T16:22:13Z https://nostr.ae/nevent1qqst7xhzxpcgudtj8fnx9gexndug54avjh897w2z2znrvd30un8uaxgzyrh6607ffhkmjkm4gddxp2l7gavx4gsdppaqy4k9j39wdp6m047yg7lncnw X41 performed an audit of Hickory DNS which is an open source Rust based DNS client, server, and resolver. We were sponsored by the great folks at <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1c8cuu3n4u3xdhz57fh5fexym7xs48wncp7drk0dvxzcv87t4dtysz6lkhj" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>OSTIF</span> (<span class="italic">npub1c8c…lkhj</span>)</a></span> and supported by <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1jsv8a3t53jzyun354qpltd6klwrlstltdatl36qng3qlzj9ltehsgrg5xu" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Prossimo</span> (<span class="italic">npub1jsv…g5xu</span>)</a></span><br/><br/>Our full report can be downloaded here: <a href="https://x41-dsec.de/security/research/job/news/2025/03/10/hickory-review-2025/">https://x41-dsec.de/security/research/job/news/2025/03/10/hickory-review-2025/</a> 2025-03-10T12:35:21Z https://nostr.ae/nevent1qqsw9jwwlhmzqasymyhpartrsjznjkw20j5vvsvp6dkyaqxlctjxjrczyrh6607ffhkmjkm4gddxp2l7gavx4gsdppaqy4k9j39wdp6m047yggu6l49 X41 Reviewed Mullvad VPN<br/><a href="https://x41-dsec.de/news/2024/12/11/mullvad/">https://x41-dsec.de/news/2024/12/11/mullvad/</a><br/><br/>Many thanks to the <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1xh7cv0xku4rqrp0yay046zw2y0wwl0mguzguq49zv2lye4a69zrs45v9hj" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Mullvad VPN</span> (<span class="italic">npub1xh7…v9hj</span>)</a></span> team for the professional and good interaction during this audit! 2024-12-11T16:39:26Z