Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

sorona.xyz bug bounty programs

envoyproxy.io Updated

Sorona.xyz runs one public program: a Sorona bug bounty paying up to $15,000.

Top reward
$15,000
Sorona
Programs
1
1 pays cash
Targets in scope
7
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program sorona.xyz runs.

  • Envoy

    Sorona · Bug bounty

    Open

    Top reward

    $15k
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

7 targets. 7 excluded.

  • https://www.envoyproxy.io

    Web

  • Envoy core components hardened against untrusted peers, those marked robust_to_untrusted_downstream_and_upstream, such as the HTTP router filter, the TLS transport socket, the decompressor, the connection-limit filter, and the DNS resolvers

    Products and areas

  • Network data-plane attacks only: the finding must arrive over the network against the edge Envoy listener on HTTPS port 10000, using the program's reference static configuration

    Products and areas

  • Only extensions carrying a stable status and a robust_to_untrusted_* posture in the security-posture manifest are eligible

    Products and areas

  • Resilience to malicious or adversarial xDS configuration where, in a multi-tenant deployment, the config itself may come from an untrusted source (config-delivered attacks against hardened components)

    Products and areas

  • Stable extensions marked robust_to_untrusted_downstream (which assume a trusted upstream), for example compression, access loggers, health checkers, and most HTTP filters, when they are exercised through untrusted downstream traffic

    Products and areas

  • Version eligibility: for point releases, only the latest point release at submission time; for development builds, only main builds cut within the last five days

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 7

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Extensions marked requires_trusted_downstream_and_upstream (Redis, Mongo, Thrift, PostgreSQL proxies, WASM, Lua, dynamic modules) and data_plane_agnostic components (resource monitors, stat sinks)

  • Extensions without stable status, everything under the contrib/ directory, and any extension of unknown posture

  • Generic DoS or brute force below the 100x amplification threshold (aside from the specified OOM-with-stream-limit case), release-build ASSERT failures, deprecated or flag-disabled features, mere lack of a safe default, and anything already public

  • Local attacks: anything delivered via a local process, shell, or path other than the network data plane, plus kernel, Docker, and container vulnerabilities

  • The admin console and admin interface

  • The control plane and xDS management server (treated as trusted), and wire-level attacks against the xDS transport protocol

  • Untrusted services invoked during request processing that Envoy treats as trusted: external authorization, rate limiting, access logging, credential suppliers, and runtime services

Recent changes

Reward and scope changes across every sorona.xyz program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in sorona.xyz products, from the NVD.

Search NVD
  • CVE-2026-111497 Critical

    A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli librarie

  • CVE-2026-73553 High

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, When ignore_path_parameters_in_path_matching is enabled, Envoy's router strips the semicolon suffix before matching but the RBAC url_path matcher evaluates the raw path. A downstream request such as /admin;x can therefore miss a DENY rule for /admin while the router

  • CVE-2026-73511 Medium

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving the resource. Envoy's ignore_path_parameters_in_path_matching option instead truncates at the first sem

  • CVE-2026-73551 Medium

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefore not canonicalized to /admin even when path normalization is enabled. If an upstream interprets the se

  • CVE-2026-73549 Medium

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's Utility::copyInternetAddressAndPort and QUIC client-address paths reconstruct scoped IPv6 addresses through addressAsString and Ipv6Instance. The string includes a percent scope identifier that inet_pton cannot parse, causing an exception or abort. Kernel-pro

  • CVE-2026-73550 High

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded value bypasses saveHeader, so its bytes and count are not charged against request header limits. An unauthenticated client can use HPACK indexin

  • CVE-2026-73552 High

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy HTTP RBAC accepts RFC-valid opaque header bytes but evaluates safe_regex values with RE2's UTF-8 subject semantics. A downstream client can preserve a prohibited marker and add an unrelated obs-text octet, causing RE2::FullMatch to return false and a negative R

  • CVE-2026-73512 High

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HttpDatagramHandler caches the current RequestDecoder when Capsule Protocol is enabled. Stream recreation, including an internal redirect, replaces the ActiveStream and updates EnvoyQuicServerStream but does not update the handler's cached pointer. A subseque

About this page

This page gathers every public program listed under envoyproxy.io: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.