Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Cap'n Proto bug bounty programs

capnproto.org Updated

Cap'n Proto runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
10
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Cap'n Proto runs.

  • Cap'n Proto

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

10 targets. 5 excluded.

  • https://capnproto.org

    Web

  • Anything that decodes a message received from an untrusted peer, whether or not that path currently carries an advisory

    Products and areas

  • capnproto.org directs security reports privately to [email protected] and draws no boundary narrower than the project itself. There is no published exclusion list, so treat the whole tree as in scope

    Products and areas

  • KJ-HTTP end to end: request and response parsing, header handling, chunked encoding, Content-Length arithmetic and WebSocket framing

    Products and areas

  • Packing and unpacking, plus the canonicalisation path

    Products and areas

  • The KJ library that ships with it, including the async framework, the event loop and the I/O layer

    Products and areas

  • The other language implementations maintained in the project tree, and the C++ serialization core they wrap

    Products and areas

  • The RPC layer and its capability model: promise pipelining, capability tables, three-party handoff and the level-3 machinery, and the membrane and revocation logic that decides what a peer may still invoke

    Products and areas

  • The schema compiler and the generated C++ code, including the accessors that enforce bounds at read time

    Products and areas

  • The wire format decoder in full: pointer validation, struct and list layouts, far pointers, the segment table and the traversal and depth limits meant to bound a malicious message

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 5

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Applications that misuse the API, for example ignoring the traversal limit the library provides, where Cap'n Proto behaved as documented

  • Cloudflare's own products and infrastructure. A finding against workerd or the Workers platform belongs in Cloudflare's programme, where workerd is bounty-eligible at critical severity

  • github.com/cloudflare/recapn, Cloudflare's separate Rust implementation, which is listed on their programme and is not this project

  • Third-party Cap'n Proto implementations maintained outside the project

  • Upstream dependency vulnerabilities, unless the project's own use of the dependency is what makes them reachable

Recent changes

Reward and scope changes across every Cap'n Proto program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Cap'n Proto products, from the NVD.

Search NVD
  • CVE-2026-32239 Medium

    Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, a negative Content-Length value was converted to unsigned, treating it as an impossibly large length instead. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.

  • CVE-2026-32240 Medium

    Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, when using Transfer-Encoding: chunked, if a chunk's size parsed to a value of 2^64 or larger, it would be truncated to a 64-bit integer. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.

  • CVE-2023-48230 Medium

    Cap'n Proto is a data interchange format and capability-based RPC system. In versions 1.0 and 1.0.1, when using the KJ HTTP library with WebSocket compression enabled, a buffer underrun can be caused by a remote peer. The underrun always writes a constant value that is not attacker-controlled, likely resulting in a crash, enabling a remote denial-of-service attack. Most Cap'n Proto and KJ users ar

  • CVE-2022-46149 Medium

    Cap'n Proto is a data interchange format and remote procedure call (RPC) system. Cap'n Proro prior to versions 0.7.1, 0.8.1, 0.9.2, and 0.10.3, as well as versions of Cap'n Proto's Rust implementation prior to 0.13.7, 0.14.11, and 0.15.2 are vulnerable to out-of-bounds read due to logic error handling list-of-list. This issue may lead someone to remotely segfault a peer by sending it a malicious m

  • CVE-2015-2310 Critical

    Integer overflow in layout.c++ in Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to cause a denial of service or possibly obtain sensitive information from memory via a crafted message, related to pointer validation.

  • CVE-2015-2311 Critical

    Integer underflow in Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 might allow remote peers to cause a denial of service or possibly obtain sensitive information from memory or execute arbitrary code via a crafted message.

  • CVE-2015-2312 High

    Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to cause a denial of service (CPU and possibly general resource consumption) via a list with a large number of elements.

  • CVE-2015-2313 High

    Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.2, when an application invokes the totalSize method on an object reader, allows remote peers to cause a denial of service (CPU consumption) via a crafted small message, which triggers a "tight" for loop. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-2312.

About this page

This page gathers every public program listed under capnproto.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.