Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

FRRouting bug bounty programs

frrouting.org Updated

FRRouting runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
8
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program FRRouting runs.

  • FRRouting

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

8 targets. 5 excluded.

  • https://frrouting.org

    Web

  • bgpd in full: UPDATE, OPEN and capability parsing, path-attribute handling, policy and route-map evaluation, and the BGP-LS, EVPN and flowspec extensions

    Products and areas

  • ospfd and ospf6d end to end, LSA parsing included, reachable from any adjacent device on a shared segment

    Products and areas

  • The management and operator surface as a whole: the VTY shell, vtysh, the mgmtd northbound YANG configuration path, and the gRPC and SNMP interfaces

    Products and areas

  • The project takes security reports at [email protected] and runs a documented embargo process over them. What is covered is upstream FRR itself, with nothing narrower carved out of the daemon set

    Products and areas

  • The rest of the routing daemons the project ships rather than only the ones carrying a CVE: isisd, babeld, ripd, ripngd, eigrpd, pimd, ldpd, nhrpd, bfdd, pbrd, staticd and vrrpd

    Products and areas

  • The shared library layer every daemon links, covering the packet stream buffers, the prefix and nexthop code and the memory allocators underneath them

    Products and areas

  • The zebra RIB and FIB daemon and its netlink boundary, where a routing-table corruption becomes a traffic redirect

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 5

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Anything that requires an already-established session with a trusted BGP peer, where the peer is the trust boundary

  • BIRD, OpenBGPD and vendor routing stacks, none of which is OSS-Fuzz integrated or covered here

  • One-line fixes for non-exploitable crashes, which the Patch Rewards rules exclude, including crashes that come from resource exhaustion

  • Patches that SONiC, Cumulus or another distribution carries on top of FRR rather than upstream code

  • Route hijacking that is a policy failure rather than a code defect: no RPKI, permissive filters, and similar operator choices

Recent changes

Reward and scope changes across every FRRouting program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in FRRouting products, from the NVD.

Search NVD
  • CVE-2026-37458 Medium

    Missing input validation in the MP_REACH_NLRI component of FRRouting (FRR) stable/10.0 to stable/10.6 allows authenticated attackers to cause a Denial of Service (DoS) via supplying a crafted UPDATE message.

  • CVE-2026-37457 High

    An off-by-one out-of-bounds write vulnerability in the bgp_flowspec_op_decode() function (bgpd/bgp_flowspec_util.c) of FRRouting (FRR) stable/10.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted FlowSpec component.

  • CVE-2026-28532 Medium

    FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic Engineering and Segment Routing TLV parser functions where a uint16_t accumulator variable truncates uint32_t values returned by the TLV_SIZE() macro, causing the loop termination condition to fail while pointer advancement continues unchecked. Attackers with an established OSPF adjacency can send a crafted LS

  • CVE-2026-5107 Low

    A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function process_type2_route of the file bgpd/bgp_evpn.c of the component EVPN Type-2 Route Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. The identifier of the patch is 7676

  • CVE-2025-61103 High

    FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_ext_link_lan_adj_sid function at ospf_ext.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted OSPF packet.

  • CVE-2025-61104 High

    FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_unknown_tlv function at ospf_ext.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted OSPF packet.

  • CVE-2025-61106 High

    FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_ext_pref_pref_sid function at ospf_ext.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted OSPF packet.

  • CVE-2025-61107 High

    FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_ext_pref_pref_sid function at ospf_ext.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted LSA Update packet.

About this page

This page gathers every public program listed under frrouting.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.