X41 D-Sec GmbH

X41 D-Sec GmbH is an expert provider for application security services. Custom research and a IT security consulting and support services are core competencies of X41 D-Sec GmbH.

Homepage: https://www.x41-dsec.de
Github: https://github.com/x41sec
LinkedIn: https://de.linkedin.com/company/x41

Last Notes

2026-10-09 14:05:54 UTC

We have published our writeup about the discovery and details of the #BadHost vulnerability (CVE-2026-48710) at https://x41-dsec.de/lab/research/2026/10/07/badhost/

2026-10-09 07:17:46 UTC

We turned Envoy's hot-restart shared memory file into an ASLR leak and an arbitrary write. The maintainers said it's not a security issue.
We think that is only half the story. When you run it on Kubernetes, it enables lateral movement into your Envoy sidecar containers.
Read more in our blogpost: https://x41-dsec.de/news/2026/10/09/envoy-on-k8s-shm/

2026-05-28 07:30:41 UTC

There's an update for the Starlette issue: We've scanned thousands of hosts for CVE-2026-48710 and found something important: Being behind a proxy or CloudFlare isn't always a protection unlike previously stated!
When a reverse proxy or CDN (including Cloudflare) sits in front of the target and rejects malformed Host headers, the X-Forwarded-Host header can sometimes be used to bypass the protection! If the backend middleware reads X-Forwarded-Host and updates the ASGI scope, the malicious value can reach the ASGI and Starlette. #badhost

2026-01-21 16:22:13 UTC

After auditing the @npub1xh7…v9hj client applications in 2024, we have recently audited Mullvad VPN's API.
The API is used by clients, partners, and internal services to manage user accounts and parts of the VPN infrastructure.
Five issues were identified, of which only one had a very limited impact on users of the service.
The technical details may be found in our report. https://www.x41-dsec.de/security/research/news/2026/01/20/mullvad/

2025-03-10 12:35:21 UTC

X41 performed an audit of Hickory DNS which is an open source Rust based DNS client, server, and resolver. We were sponsored by the great folks at @npub1c8c…lkhj and supported by @npub1jsv…g5xu
Our full report can be downloaded here: https://x41-dsec.de/security/research/job/news/2025/03/10/hickory-review-2025/

2024-12-11 16:39:26 UTC

X41 Reviewed Mullvad VPN
https://x41-dsec.de/news/2024/12/11/mullvad/
Many thanks to the @npub1xh7…v9hj team for the professional and good interaction during this audit!