GnuTLS bug bounty programs
gnutls.org Updated
GnuTLS runs one public program: a Sorona bug bounty paying up to $1,500.
- Top reward
- $1,500
- Sorona
- Programs
- 1
- 1 pays cash
- Targets in scope
- 10
- 2 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program GnuTLS runs.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
GnuTLS
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | – | Open |
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
10 targets. 7 excluded.
-
https://www.gnutls.org
Web
-
ASN.1 and DER decoding paths inside GnuTLS that process attacker-supplied certificates and structures
Products and areas
-
Client-side denial of service or memory corruption triggered by a malicious or compromised server
Products and areas
-
Import parsing of PKCS containers from untrusted data (PKCS#7, PKCS#8, PKCS#12) and other certificate or key material
Products and areas
-
Memory-safety defects in the core libgnutls library reachable from untrusted network peers: heap and stack overflows, use-after-free, and out-of-bounds reads or writes
Products and areas
-
Protocol-level cryptographic handling exposed by the library, including timing and side-channel exposure in supported operations
Products and areas
-
Remote unauthenticated conditions that lead to crash, hang, memory disclosure, or code execution
Products and areas
-
Server-side denial of service or memory-safety failure triggered by malicious peer input
Products and areas
-
The TLS and DTLS handshake and record layers, covering key exchange, session resumption, and fragment reassembly across TLS 1.0 through 1.3
Products and areas
-
X.509 certificate parsing and chain building, including path validation, name-constraint enforcement, and CRL/OCSP handling, and any bug that lets an attacker bypass verification
Products and areas
No target matches. Try part of a host name, such as the company name.
Out of scope 7
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Application-side API misuse: invalid enum values, calling functions after deinit, or invoking the API out of the documented order
-
Attacks that assume the attacker can already alter trusted inputs such as private keys or the trusted CA store, which sit inside the trust boundary
-
Defects that actually live in bundled dependencies rather than GnuTLS itself, including nettle, libtasn1, gmp, and p11-kit, which belong upstream to those projects
-
Objections to default algorithm, cipher, or protocol selection, which are policy and configuration matters rather than vulnerabilities
-
Obsolete or deprecated subsystems: the OpenSSL compatibility layer, SRP, TPM 1.2, DTLS 0.9, and SSL 3.0
-
Problems confined to the diagnostic command-line utilities such as gnutls-cli, gnutls-serv, and gnutls-cli-debug rather than the library
-
Technology-preview features, including PKCS#11 provider mode and HPKE
Recent changes
Reward and scope changes across every GnuTLS program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
About this page
This page gathers every public program listed under gnutls.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.