Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Espressif bug bounty programs

espressif.com Updated

Espressif runs one public program: a Sorona bug bounty paying up to $3,600.

Top reward
$3,600
Sorona
Programs
1
1 pays cash
Targets in scope
9
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Espressif runs.

  • Espressif ESP-IDF

    Sorona · Bug bounty

    Open

    Top reward

    $3,600
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

9 targets. 6 excluded.

  • https://www.espressif.com

    Web

  • ESP-IDF core: the FreeRTOS port, the heap and its poisoning checks, memory-protection unit configuration, task isolation, and the bootloader and startup code beneath all of it

    Products and areas

  • esp_https_ota together with the OTA state machine, rollback and anti-rollback logic, where a defect turns the update channel into the compromise channel

    Products and areas

  • Espressif takes security issues in its own software solutions, filed on the structured form to [email protected], and ESP-IDF is a named product: the SDK's own SECURITY.md routes reporters into the same incident-response process. Rewards run $200 to $3,600 at Espressif's discretion, on one flat band rather than a severity ladder

    Products and areas

  • Secure Boot v2 signature verification, Flash Encryption, and the eFuse and key-management code across ESP32, ESP32-S2/S3/C3/C6/H2 and later parts

    Products and areas

  • The host-side tooling Espressif ships with the SDK, including the idf.py build front end, the flashing utilities and the signing and eFuse programming tools that handle key material

    Products and areas

  • The networking and application components that carry a device's traffic: esp-tls, the HTTP and HTTPS server and client, MQTT, WebSocket, mDNS and the Wi-Fi provisioning components

    Products and areas

  • The storage stack: the NVS partition parser and its encryption, partition-table handling, the SPIFFS and FAT wrappers, and the SPI flash driver underneath them

    Products and areas

  • The wireless stacks and their over-the-air packet parsers, which are the pre-authentication remote surface a device exposes simply by being powered on: Wi-Fi, Bluetooth and BLE, and 802.15.4 with Thread on the parts that carry a radio for it

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Anything filed as a public GitHub issue, which disqualifies the report regardless of how good the bug is

  • Example-only code, unless you can show the same pattern exists in the production SDK

  • Issues in software outside Espressif's longevity commitment period, meaning parts and releases past their supported window

  • Physical-attack and glitching research against the silicon, which the program's text does not address at all and should be assumed out

  • Third-party services not operated by Espressif

  • Vulnerabilities in third-party libraries, which the program excludes verbatim: that carve-out takes mbedTLS, lwIP and ArduinoJson out even though they are vendored into or used alongside ESP-IDF

Recent changes

Reward and scope changes across every Espressif program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Espressif products, from the NVD.

Search NVD
  • CVE-2026-45160 Medium

    ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.7, 5.3.5, 5.4.4, 5.5.4, and 6.0.1, an out-of-bounds read flaw exists in the DHCP server option parser (parse_options() in components/lwip/apps/dhcpserver/dhcpserver.c) shipped with ESP-IDF's lwIP component. The parser walks the BOOTP/DHCP options field without validating that each option's length byte and decl

  • CVE-2026-45328 Critical

    ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, the esp_tee component exposes secure-service wrappers in esp_secure_services.c and esp_secure_services_iram.c that bridge calls from the user application (i.e. the REE) to TEE-protected hardware peripherals (AES, SHA, ECC, HMAC, SPI, MMU, WDT) and to the security feature like attestation, OTA update

  • CVE-2026-45329 High

    ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, several ESP-TEE secure-service wrappers in esp_secure_services.c and esp_secure_services_iram.c validated only some of the caller-supplied pointer arguments, leaving input pointer arguments unchecked. Because the underlying TEE-protected hardware peripherals (e.g., ECC, SHA, SPI) run in RISC-V machi

  • CVE-2026-45541 High

    ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0, a NULL-pointer dereference exists in the WebSocket subprotocol-negotiation path of the esp_http_server component. While parsing the client-supplied Sec-WebSocket-Protocol request header during the WebSocket handshake, the tokenisation result is dereferenced without a NULL check

  • CVE-2026-45542 High

    ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0, a heap buffer overflow exists in the Security Scheme 2 (SRP6a) session-setup path of the protocomm component. The first-phase handler (handle_session_command0() in components/protocomm/src/security/security2.c) trusts the length of a client-supplied protobuf field for the SRP6a

  • CVE-2026-46532 Medium

    ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.3, and 6.0, an out-of-bounds read exists in the BlueDroid AVRCP vendor-command parser (avrc_pars_vendor_cmd() in components/bt/host/bluedroid/stack/avrc/avrc_pars_tg.c). This issue has been patched in versions 5.2.7, 5.3.6, 5.4.5, 5.5.4, and 6.0.1.

  • CVE-2026-42854 Critical

    arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, the WebServer multipart form parser in arduino-esp32 allocates a Variable Length Array (VLA) on the stack whose size is derived from an attacker-controlled HTTP header field (Content-Type: multipart/form-data; boundary=...) without enforcing any length limit. Sendin

  • CVE-2026-42855 High

    arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, the WebServer Digest authentication implementation in arduino-esp32 computes the authentication hash using the URI field from the client's Authorization header, without verifying that it matches the actual requested URI. This allows an attacker who possesses any val

About this page

This page gathers every public program listed under espressif.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.