Home / Technology / Mullvad's GotaTun Passes Security Audit
Mullvad's GotaTun Passes Security Audit
10 Mar
Summary
- Mullvad's GotaTun protocol underwent its first security audit.
- The audit by Assured Security Consultants found no major vulnerabilities.
- Two low-severity issues related to session identifiers and packet padding were fixed.
Mullvad's GotaTun protocol, a core technology for its VPN service, has successfully completed its initial independent security audit. Conducted by Assured Security Consultants between January 19 and February 15, 2026, the audit assessed GotaTun v0.2.0, revealing no major security flaws.
Mullvad, a VPN provider prioritizing privacy and security, developed GotaTun in Rust to enhance connection speed and reliability. The protocol supports advanced features like Multihop and DAITA. The audit identified two low-severity vulnerabilities: static session identifiers deviating from WireGuard specifications and improper packet padding. Both issues have been resolved by Mullvad in the subsequent GotaTun v0.4.0 release.
The audit also noted that GotaTun did not always correctly handle user IP address changes, though this did not impact Mullvad's service as its servers maintain stable IP addresses. With these fixes implemented, Mullvad has increased confidence in GotaTun's reliability as it continues its rollout across platforms throughout 2026.
