'No major vulnerabilities' — Mullvad’s Wire Guard implementation gets thumbs up from independent security audit | Tech Radar

Overview

'No major vulnerabilities' — Mullvad’s Wire Guard implementation gets thumbs up from independent security audit

Two minor issues requiring correction were identified and reported, but Mullvad claims to have already resolved them

Details

When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.

New audit found no significant vulnerabilities in Mullvad's Gota Tun

Minor identified issues are already fixed, says Mullvad

Gota Tun replaced the old Wire Guard implementation in December

Mullvad VPN's Wire Guard implementation, Gota Tun, has received the green light in a security audit completed by independent auditors, reporting no significant vulnerabilities.

Written in the Rust programming language, Gota Tun is a user-space implementation of the Wire Guard network tunneling protocol that Mullvad introduced as an open-source replacement for its previous Go-based implementation.

Implemented in December, shortly before Mullvad’s complete retirement of the Open VPN protocol, it has so far brought faster performance, longer battery life on mobile devices, and significantly fewer app crashes, making the app much more stable overall.

"In conclusion, the reviewed scope appears to be on a good security level compared to systems of similar size and complexity." — Independent review confirms Mullvad’s strong privacy protections

Mullvad VPN boosts Wire Guard speeds and stability with new Rust-based engine

But even the best VPNs cannot simply claim that their new code is free of security flaws; a third-party auditor is needed to verify that the code is indeed up to par.

Between January 19 and February 15, Gothenburg-based Assured Security Consultants conducted a brief review of Gota Tun's code to test its entire configuration, with the exception of the command line interface and specific DAITA code.

The code got the all clear, reassuring Mullvad’s users that the VPN has accurately and securely implemented the Wire Guard protocol in their native programming language.

"Based on our code review, Gota Tun has no major vulnerabilities," auditors conclude in their report.

This will be happily received by users who had previously experienced crashes from the earlier non-Rust implementation, who can now rest assured that the new, sleeker user experience is accompanied by continued levels of security.

Our Wire Guard implementation, Gota Tun was recently audited by Assured Security Consultants. Two identified low severity issues were fixed prior to the completion of the audit. No major vulnerabilities were found. Read more here: https://t.co/ou Hl Ghr 8 Jg March 6, 2026

Our Wire Guard implementation, Gota Tun was recently audited by Assured Security Consultants. Two identified low severity issues were fixed prior to the completion of the audit. No major vulnerabilities were found. Read more here: https://t.co/ou Hl Ghr 8 Jg March 6, 2026

Indeed, Mullvad had previously reported that 85% of all crashes logged on its Android app were directly related to conflicts between Mullvad's Rust code and Wire Guard's Go implementation.

It was then that the privacy VPN team rewrote the Wire Guard implementation in Rust to fit their stack: Gota Tun, or “the future of Wire Guard,” as Mullvad called it, whose implementation virtually eliminated these issues, with a crash rate on Android dropping from 0.4% to around 0.01%.

Connectivity issues? Mullvad’s Open VPN shutdown is happening today – here's all you need to do to keep using the VPN

Independent auditors inspect Nord VPN's security once again – here's what they found

Mullvad retires Open VPN support on desktop, pushing all users to Wire Guard

The audit further confirmed that both Mullvad and its users have reason to celebrate and fears of crashes are now unfounded: the code is fit for purpose.

However, it is important to note that the audit results were not flawless. Two minor issues were identified and reported for correction, where Mullvad's Rust implementation did not perfectly follow the official Wire Guard protocol.

A padding error indicated that the format of the numerical data sent by the Rust implementation was not consistent with the protocol specifications.

A second issue also highlighted that, while the Wire Guard protocol requires the assignment of a random number, Mullvad did not use a completely random method, but a more predictable method to generate the number.

The audit also pointed out that the Rust Wire Guard code still contains three comments saying "TODO: validate checksums," with the last instance having a question mark at the end. These should be replaced with comments explaining why checksums are not necessary, the auditors said.

Finally, some parts of the code are mainly maintained by very small teams, consisting of one or two people. While this does not currently pose any security risks, it does raise some long-term concerns in terms of quality and maintenance, as statistically larger teams tend to find more bugs and reduce potential code flaws in the future, the auditors said.

Mullvad stated that most of these recommendations had been fixed before the publication of the results, a claim that will likely be verified in their next audit.

However, for existing and potential Mullvad users, these current results reinforce Mullvad's status as a VPN that prioritises user privacy and anonymity, continuing to improve its core principles through meaningful third-party evaluations.

And it seems that, for now, no app crash will prevent it from achieving its goal.

Follow Tech Radar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!

Silvia Iacovcich is a tech journalist with over five years of experience in the field, including AI, cybersecurity, and fintech. She has written for various publications focusing on the evolving regulatory landscape of AI, digital behavior, web 3, and blockchain, as well as social media privacy and security regulations.

You must confirm your public display name before commenting

1'No major vulnerabilities' — Mullvad’s Wire Guard implementation gets thumbs up from independent security audit

2 Anthropic says it found a heap of Firefox security flaws using new Claude tools, says 'AI is making it possible to detect severe security vulnerabilities at highly accelerated speeds'

3 Can't afford a Leica? The latest craze in China is just engraving the name into Panasonic cameras instead

4 What is the release date for Scrubs season 10 episode 4 on Hulu and Disney+?

5 Asus just released new open earbuds... for gaming?

Tech Radar is part of Future US Inc, an international media group and leading digital publisher. Visit our corporate site.

© Future US, Inc. Full 7th Floor, 130 West 42nd Street, New York, NY 10036.

Key Takeaways

• 'No major vulnerabilities' — Mullvad’s Wire Guard implementation gets thumbs up from independent security audit

• Two minor issues requiring correction were identified and reported, but Mullvad claims to have already resolved them

• When you purchase through links on our site, we may earn an affiliate commission

• New audit found no significant vulnerabilities in Mullvad's Gota Tun

• Minor identified issues are already fixed, says Mullvad