Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

sorona.xyz bug bounty programs

clamav.net Updated

Sorona.xyz runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
8
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program sorona.xyz runs.

  • ClamAV

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

8 targets. 6 excluded.

  • https://www.clamav.net

    Web

  • Archive and container handling end to end, including the size and offset arithmetic that a later allocation or copy trusts

    Products and areas

  • ClamAV publishes its security policy in the Cisco-Talos/clamav repository and takes reports on the engine through it. Signature-database and detection-quality questions sit outside, since those are a content matter rather than a defect in the code, and everything below sits inside

    Products and areas

  • The bytecode interpreter, which executes signature logic against attacker-supplied content

    Products and areas

  • The clamd daemon and its client tooling, covering the scan protocol, the worker model, and the sandboxing and privilege separation that decide what a parser bug reaches once it fires

    Products and areas

  • The database and signature-file loading path, where the engine parses files it did not itself produce

    Products and areas

  • The Rust components already in the tree and the ongoing migration of untrusted-input parsers from C to Rust, a named qualifying-patch category

    Products and areas

  • The scanning engine and every file-format parser it ships: OLE2, PDF, HFS+, UDF, XAR, ARJ, CHM and the various unpackers, all of them driven by a file an attacker chose

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • A vulnerability report on its own where the patch money is concerned: that rail pays only on a change merged upstream that then survives a month without reverts

  • One-liner patches that fix non-exploitable crashes, and denial of service by resource exhaustion, which is called out by name and which describes a large fraction of ClamAV's historical fuzz findings

  • Patches Cisco Talos declines, since Google explicitly declines to second-guess a maintainer's decision

  • Patches outside the one-to-twelve-month age window, and anything past three submissions per person per month

  • Signature-database or detection-quality issues, which are not a question about the security of the code

  • The Tier 1 ceiling and the Tier 1 memory-safety multiplier, neither of which ClamAV can reach: it qualifies at Tier 2 through OSS-Fuzz, not as a named Tier 1 project

Recent changes

Reward and scope changes across every sorona.xyz program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in sorona.xyz products, from the NVD.

Search NVD
  • CVE-2026-20244 High

    A vulnerability in the DMG file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in DMG files during scanning, which may result in an integer overflow on 32-bit platforms only. An attacker coul

  • CVE-2026-20214 High

    A vulnerability in the FSG file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in FSG files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this

  • CVE-2026-20215 High

    A vulnerability in the 7z file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in 7z files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vu

  • CVE-2026-20216 High

    A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper handling of temporary resources during file scanning. An attacker could exploit this vulnerability by submitting a crafted InstallShield file to be scanned by ClamAV on an affected device. A successfu

  • CVE-2026-20217 High

    A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PESpin files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit

  • CVE-2026-20243 High

    A vulnerability in the ALZ file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in ALZ files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this

  • CVE-2026-20213 High

    A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PE files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vu

  • CVE-2025-20260 Critical

    A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device. This vulnerability exists because memory buffers are allocated incorrectly when PDF files are processed. An attacker could exploit this vulnerability by submitting a

About this page

This page gathers every public program listed under clamav.net: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.