sorona.xyz bug bounty programs
gnome.org Updated
Sorona.xyz runs 5 public programs on Sorona and its own site; 4 pay cash, the most up to $1,500 (libsoup).
- Top reward
- $1,500
- Sorona
- Programs
- 5
- 4 pay cash
- Targets in scope
- 48
- 3 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
5 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
libsoup
Sorona · Pays the most of the 5 programs: up to $1,500.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
libsoup
Sorona · Bug bounty |
– | – | – | $100 (highest) | $1,500 | Partial | – | – | Open |
|
libxml2
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | – | Open |
|
GDM
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | 2 days promised | Open |
|
GNOME Shell + Mutter
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | 2 days promised | Open |
|
GNOME
Self-hosted · Disclosure only |
– | – | – | – | No cash | – | – | 2 days promised | Open |
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100 (highest)
- Safe harbor
- Partial
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
- First response
- 2 days promised
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
- First response
- 2 days promised
-
- First response
- 2 days promised
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
48 targets across all 5 programs, each listed once with the programs that cover it. 23 excluded.
-
Authentication negotiation across Basic, Digest, NTLM and Negotiate, including how a challenge from an untrusted origin is parsed
Products and areas
Covered by libsoup
-
Automatic login and timed login handling, including the window between boot and an authenticated session
Products and areas
Covered by GDM
-
Canonical XML (c14n) serialization and the HTML parser (htmlParse) code paths
Products and areas
Covered by libxml2
-
Clipboard, primary selection and drag-and-drop as the compositor arbitrates them between clients
Products and areas
Covered by GNOME Shell + Mutter
-
Configuration file parsing, custom.conf handling and the session and language selection data read from user-writable locations
Products and areas
Covered by GDM
-
Content-Encoding and chunked transfer decoding, historically the richest source of length-confusion and overflow bugs in any HTTP stack
Products and areas
Covered by libsoup
-
Cookie jar handling and same-site logic, which decides what credentials leave the machine and for whom
Products and areas
Covered by libsoup
-
Document parsing of untrusted XML through the xmlReadFile, xmlReadMemory, xmlReadDoc, and xmlParseFile family and related APIs
Products and areas
Covered by libxml2
-
DTD handling and entity processing, covering internal and external entities and entity-reference expansion, plus DTD validation
Products and areas
Covered by libxml2
-
GNOME's security process publishes no component scope list. It takes a private report on any GNOME project through a single form, so both trees below are inside it and nothing narrower is carved out
Products and areas
Covered by GNOME Shell + Mutter
-
GNOME's security process publishes no component scope list. It takes a private report on any GNOME project through a single form, so the whole GDM tree below is inside it and nothing narrower is carved out
Products and areas
Covered by GDM
-
GNOME's SECURITY.md takes a libsoup security issue as a confidential issue on GNOME GitLab, and Google's Tier 2 row covers the whole library rather than the client half only. Everything below is inside that
Products and areas
Covered by libsoup
-
HTTP/1.1 and HTTP/2 request and response parsing in full, the surface a hostile server reaches the moment a page loads
Products and areas
Covered by libsoup
-
Input handling end to end through Clutter and libinput: keyboard grabs, pointer and touch routing, keybinding dispatch and the special-key path that reaches the shell before any application
Products and areas
Covered by GNOME Shell + Mutter
-
Monitor configuration, output handling and the display-management interfaces
Products and areas
Covered by GNOME Shell + Mutter
-
Mutter as a Wayland compositor: protocol object lifetimes, surface and subsurface handling, buffer management and every Wayland protocol extension it implements
Products and areas
Covered by GNOME Shell + Mutter
-
Mutter as an X11 window manager and its Xwayland integration, covering window property handling, selections, override-redirect windows and the X client boundary
Products and areas
Covered by GNOME Shell + Mutter
-
PAM integration and the authentication conversation, including how a result from a PAM module is interpreted and what happens on partial or repeated failure
Products and areas
Covered by GDM
-
Reader, writer, and tree memory management around parsed documents, including character-encoding conversion
Products and areas
Covered by libxml2
-
Screen capture, screencast and remote-desktop interfaces, including the portal-facing surface and what an application is allowed to record
Products and areas
Covered by GNOME Shell + Mutter
-
Smartcard, fingerprint and other alternative authentication paths GDM wires into PAM
Products and areas
Covered by GDM
-
soupserver, the server side of the library, which Google's Tier 2 row covers even though upstream has historically treated it as lower priority
Products and areas
Covered by libsoup
-
SoupSession, connection reuse and the connection pool, where state from one exchange can bleed into the next
Products and areas
Covered by libsoup
-
The core XML parser entry points, including the SAX and SAX1 callback interfaces, the push parser, and the xmlReader streaming interface
Products and areas
Covered by libxml2
-
The D-Bus interfaces both projects expose on the session bus and what an unprivileged client can drive through them
Products and areas
Covered by GNOME Shell + Mutter
-
The D-Bus interfaces GDM exposes on the system bus and what an unprivileged local client can reach through them
Products and areas
Covered by GDM
-
The GDM daemon itself, which runs as root and supervises every graphical session on the machine
Products and areas
Covered by GDM
-
The GNOME Shell JavaScript layer and the GJS boundary, including the extension API, extension installation and the privileges an installed extension inherits
Products and areas
Covered by GNOME Shell + Mutter
-
The greeter path in full: how the login screen is launched, what it is allowed to do before authentication and what it inherits from the daemon
Products and areas
Covered by GDM
-
The lock screen and screen shield in full: the unlock dialogue, the authentication prompt, the notification and media controls exposed while locked, and every transition into and out of the locked state
Products and areas
Covered by GNOME Shell + Mutter
-
The search provider mechanism, the notification path and the on-screen keyboard, all of which render content from other applications
Products and areas
Covered by GNOME Shell + Mutter
-
The session and login handling GNOME Shell performs, including the greeter mode it runs in for GDM and the switch-user path
Products and areas
Covered by GNOME Shell + Mutter
-
The switch-user and user-switching flow, where two sessions exist at once and one of them is locked
Products and areas
Covered by GDM
-
The unlock path after a session is locked, and the handoff between the session's own lock and GDM's
Products and areas
Covered by GDM
-
The X11 and Wayland session setup GDM performs, including display server launch, authority file handling and the environment handed to the new session
Products and areas
Covered by GDM
-
User and seat handling through logind and accountsservice, covering the user list shown on the greeter, session registration and multi-seat configurations
Products and areas
Covered by GDM
-
Xauth cookie generation and file handling, and anything else GDM writes on a path a local user can influence
Products and areas
Covered by GDM
-
XML Schema 1.0 (XSD) and RELAX NG validation, and Schematron processing, where several recent use-after-free and denial-of-service advisories have landed
Products and areas
Covered by libxml2
No target matches. Try part of a host name, such as the company name.
Out of scope 23
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
An administrator's configuration decision, such as enabling automatic login or displaying the user list, where GDM behaves as documented
GDM
-
Application-level misuse of the libsoup API rather than a defect in the library
libsoup
-
Attacks that require the attacker to already be running code as the logged-in user, unless the finding crosses out of that user's boundary
GNOME Shell + Mutter
-
Attacks that require the attacker to already have a shell as the target user
GDM
-
Bugs already public in the issue tracker or already fixed in a newer release
libxml2
-
Bugs that actually live in GnuTLS or glib-networking and are merely reached through libsoup
libsoup
-
Crashes reachable only through deliberately unsafe or non-default build options
libxml2
-
Denial of service that requires an already-privileged local attacker
libsoup
-
Distribution packaging and distro-specific GDM patches rather than upstream GDM
GDM
-
Distribution packaging and distro-specific patches rather than upstream gnome-shell or mutter
GNOME Shell + Mutter
-
Feature requests reframed as security issues, or purely theoretical claims with no reproducer or realistic attack path
libxml2
-
Findings in third-party bindings, packagers, or downstream forks rather than upstream libxml2
libxml2
-
GDM's own greeter process and PAM handling, which is a separate project with its own entry
GNOME Shell + Mutter
-
GNOME Shell's own code, including the greeter session it provides. That belongs to the gnome-shell and mutter trees
GDM
-
GTK, GLib, gdk-pixbuf, pango and other libraries beneath the shell; some of those ship in ChromeOS and are paid there
GNOME Shell + Mutter
-
Missing compiler hardening, best-practice suggestions, or static-analyzer noise with no demonstrated impact
libxml2
-
PAM modules themselves and the underlying pam library, which are separate upstreams
GDM
-
Patches outside the one-to-twelve-month age window the program requires
libsoup
-
Reports that reduce to feeding untrusted data to a library its own README warns is not built to process it, absent a distinct memory-safety or logic flaw
libxml2
-
systemd-logind, accountsservice and polkit as projects, though GDM's use of them is in scope
GDM
-
Third-party GNOME Shell extensions, which are not part of either tree. An extension that grants itself privilege is that extension's defect
GNOME Shell + Mutter
-
Vulnerability reports with no merged patch behind them, which earn nothing on Google's rail
libsoup
-
Xwayland internals, which share the xserver repository with the X.Org Server and are reachable through the ChromeOS VRP as x11-base/xwayland
GNOME Shell + Mutter
Recent changes
Reward and scope changes across every sorona.xyz program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in sorona.xyz products, from the NVD.
-
CVE-2026-102559 High
A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow.
-
CVE-2026-102559 High
A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow.
-
CVE-2026-102560 High
A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow.
-
CVE-2026-102559 High
A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow.
-
CVE-2026-102559 High
A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow.
-
CVE-2026-102560 High
A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow.
-
CVE-2026-102560 High
A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow.
-
CVE-2026-102560 High
A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow.
About this page
This page gathers every public program listed under gnome.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.