Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

sorona.xyz bug bounty programs

avahi.org Updated

Sorona.xyz runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
6
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program sorona.xyz runs.

  • Avahi

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

6 targets. 5 excluded.

  • https://avahi.org

    Web

  • avahi-dnsconfd and the path on which the daemon writes resolver configuration for the rest of the system

    Products and areas

  • Record and hostname conflict resolution, and the probe and announce state machine that drives it

    Products and areas

  • The client library libavahi-client, which browsers, printing stacks and file managers link against and feed with daemon-supplied data

    Products and areas

  • The D-Bus interface exposed by avahi-daemon, where a local unprivileged caller reaches a daemon that has historically run as root

    Products and areas

  • The mDNS and DNS-SD packet parser in avahi-core, reachable from any unauthenticated host on the local link, the origin of CVE-2021-3468 and of the 2023 CVE-2023-1981 assert cluster

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 5

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • AppArmor and SELinux policy gaps introduced by a distribution rather than by Avahi itself

  • Apple's Bonjour and mDNSResponder, which are a different implementation of the same protocol

  • Local denial of service triggered by a user who already holds a session on the machine

  • One-line fixes for non-exploitable crashes, which the Patch Rewards rules exclude by name along with resource-exhaustion denial of service

  • The fact that mDNS has no authentication, which is a property of the protocol rather than a defect in this implementation

Recent changes

Reward and scope changes across every sorona.xyz program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in sorona.xyz products, from the NVD.

Search NVD
  • CVE-2026-34933 Medium

    Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version 0.9-rc4.

  • CVE-2026-24401 Medium

    Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., "h.local" as a CNAME for "h.local"). This causes unbounded recur

  • CVE-2025-68276 Medium

    Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can be done by either calling the RecordBrowserNew method directly or creating hostname/address/servi

  • CVE-2025-68468 Medium

    Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs. As soon as they expire avahi-daemon crashes.

  • CVE-2025-68471 Medium

    Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart.

  • CVE-2025-59529 Medium

    Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions up to and including 0.9-rc5, the simple protocol server ignores the documented client limit and accepts unlimited connections, allowing for easy local DoS. Although `CLIENTS_MAX` is defined, `server_work()` unconditionally `accept()`s and `client_new()` always appends the new cl

  • CVE-2023-38473 Medium

    A vulnerability was found in Avahi. A reachable assertion exists in the avahi_alternative_host_name() function.

  • CVE-2023-38469 Medium

    A vulnerability was found in Avahi, where a reachable assertion exists in avahi_dns_packet_append_record.

About this page

This page gathers every public program listed under avahi.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.