Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Erlang/OTP bug bounty programs

erlang.org Updated

Erlang/OTP runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
13
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Erlang/OTP runs.

  • Erlang/OTP

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

13 targets. 6 excluded.

  • https://www.erlang.org

    Web

  • Distribution and clustering: the node handshake, the distribution protocol, cookie-based authentication and everything a connected node is trusted to do

    Products and areas

  • erl_interface, jinterface and the external term format, including binary_to_term on untrusted input

    Products and areas

  • inets and the HTTP client and server code inside it

    Products and areas

  • mnesia, ets and dets and the storage layers OTP applications keep state in

    Products and areas

  • public_key and asn1, which decode attacker-supplied structures before any trust decision has been made

    Products and areas

  • The BEAM virtual machine: bytecode loading and verification, the schedulers, the memory allocators and the garbage collector

    Products and areas

  • The Erlang compiler and the bytecode it emits, plus the module loading path that accepts a compiled module

    Products and areas

  • The NIF and port-driver boundary, where native code runs inside the VM with no isolation from it

    Products and areas

  • The published policy asks for any vulnerability in Erlang/OTP through one of two private channels and rules out public reporting. It draws no line narrower than the OTP distribution itself

    Products and areas

  • The ssh application, a full server implementation and one of the OTP components most often exposed directly to the internet

    Products and areas

  • The ssl and crypto applications, covering the TLS state machine, certificate validation and the OpenSSL bindings underneath

    Products and areas

  • The stdlib parsers and formatters, xmerl and zlib among them, that OTP applications feed unvalidated data into

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Anything reported through a public channel, which the policy rules out by name

  • Elixir, a separate project on the same virtual machine with its own private advisory channel

  • OpenSSL itself, as distinct from OTP's crypto and ssl bindings to it

  • Operating a distributed Erlang cluster on an untrusted network with a shared cookie, a documented deployment decision rather than a defect

  • RabbitMQ, CouchDB, ejabberd, Riak and the other products built on OTP, each with its own security process

  • Third-party Erlang libraries pulled in through rebar3 or Hex

Recent changes

Reward and scope changes across every Erlang/OTP program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Erlang/OTP products, from the NVD.

Search NVD
  • CVE-2026-59251 High

    Allocation of resources without limits in Erlang/OTP public_key certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted X.509 certificate chain during the TLS handshake. During RFC 5280 policy processing in public_key:pkix_path_validation/3, the certificate policy tree maintained by pubkey_policy_tree grows without an upper bound. When a

  • CVE-2026-58227 High

    The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In ssl_certificate:handle_incomplete_chain/5, the received chain is passed to ssl_certificate:build_certificate_chain/5, which walks issuer relationships via ssl_certificate:do_certificate_chain/7 with no cycle detection and no depth limit. When the peer su

  • CVE-2026-55953 Critical

    The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tls_handshake:hello/5 handler validates the negotiated protocol version and the downgrade sentinel but hands the server-chosen suite directly to ssl_handshake:handle_server_hello_extensions/9,

  • CVE-2026-55737 Medium

    Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term format (ETF) binary to binary_to_term/1 to corrupt the BEAM heap pointer and crash the virtual machine. When decoding a LARGE_TUPLE_EXT term, the validation pass decoded_size() in erts/emulator/beam/external.c reads the 32-bit arity field as

  • CVE-2026-54890 High

    Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c. The BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both leng

  • CVE-2026-42792 Medium

    Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote attacker to permanently terminate the Erlang Port Mapper Daemon (epmd) via connection slot exhaustion. The do_accept function in erts/epmd/src/epmd_srv.c calls epmd_cleanup_exit() when accept(2) returns EMFILE (per-process file descriptor limit reached) or ENFILE (system-wide file d

  • CVE-2026-54887 Medium

    Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl (DTLS server) allows predictable DTLS cookie computation during the startup window, enabling source address verification bypass. On DTLS server startup, dtls_server_connection:initial_hello/3 initializes previous_cookie_secret to the empty binary (<<>>) instead of a random value. Because HMAC with an empty key is deterministic, anyon

  • CVE-2026-54891 Medium

    Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Erlang/OTP ssl (tls_gen_connection module) allows a network-positioned attacker to inject unauthenticated plaintext that the TLS client application later treats as authenticated server data. The function tls_gen_connection:handle_protocol_record/3 rejects APPLICATION_DATA records that arrive i

About this page

This page gathers every public program listed under erlang.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.