At Tuta we are building a privacy-first alternative to big tech offerings so that everyone can protect their data online by sending encrypted emails and sharing encrypted events with Tuta Mail and Tuta Calendar. This brings our service to the forefront of all kinds of adversaries. As a consequence, Tuta is regularly being attacked with DDoS attacks. While most of the times, we can fend off these attacks without you noticing, the adversaries changed their attack vectors beginning of December which led to several downtimes during the first week of December. We have now immensely improved our DDoS-protection methods and our systems are capable of fending off these attacks. Now, we would like explain what happened and how we mitigated the attacks.
Explanation on recent DDoS attacks & why we do not use third-parties for mitigation.
Recent Posts
- CVE-2024-57823 – Raptor Turtle Parser Integer Underflow Vulnerability
- CVE-2024-57822 – Raptor RDF Syntax Library Heap-Based Buffer Over-Read Vulnerability
- CVE-2025-23016 – FastCGI fcgi2 Buffer Overflow
- CVE-2025-21380 – Azure SaaS Resource Authentication Bypass
- CVE-2025-21385 – Microsoft Purview SSRF