sorona.xyz bug bounty programs
libarchive.org Updated
Sorona.xyz runs one public program: a Sorona bug bounty paying up to $1,500.
- Top reward
- $1,500
- Sorona
- Programs
- 1
- 1 pays cash
- Targets in scope
- 7
- 2 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program sorona.xyz runs.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
libarchive
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | – | Open |
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
7 targets. 5 excluded.
-
https://libarchive.org
Web
-
[email protected] takes security reports on libarchive itself, and the boundary the maintainers draw is that one: a defect in a downstream consumer belongs with that project. Everything below sits inside the library
Products and areas
-
Extraction-time path handling: .. traversal, absolute paths, symlink and hardlink placement, and ACL and extended-attribute restore, all of which can write outside the destination
Products and areas
-
Memory accounting for compressed data with hostile expansion ratios, where a small archive claims an allocation large enough to kill the process doing the install
Products and areas
-
The bsdtar and bsdcpio command-line front ends, which are what macOS, FreeBSD and a great many scripts actually invoke
Products and areas
-
The filter chain that sits under those readers: gzip, bzip2, xz, lzma, lz4, zstd and compress, including the transitions between filters
Products and areas
-
The format readers in full: tar with its GNU, pax and ustar extensions, cpio, .rpm-adjacent payloads, ISO9660, 7-Zip, RAR, ZIP, LHA, XAR and WARC, every one of which parses bytes an attacker chose
Products and areas
No target matches. Try part of a host name, such as the company name.
Out of scope 5
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Distribution-specific patches rather than defects in upstream libarchive
-
Downstream consumers such as pacman, CMake and Homebrew rather than libarchive itself, which belong with those projects
-
One-line patches that fix non-exploitable crashes, including crashes that only amount to resource exhaustion, which the Patch Rewards rules say will not generally be rewarded
-
Performance and format-compatibility issues, which are quality problems rather than security ones
-
Raw fuzzer crashes with no merged fix behind them, which earn nothing on the Google patch pathway
Recent changes
Reward and scope changes across every sorona.xyz program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in sorona.xyz products, from the NVD.
-
CVE-2026-5745 Medium
A flaw was found in libarchive. A NULL pointer dereference vulnerability exists in the ACL parsing logic, specifically within the archive_acl_from_text_nl() function. When processing a malformed ACL string (such as a bare "d" or "default" tag without subsequent fields), the function fails to perform adequate validation before advancing the pointer. An attacker can exploit this by providing a malic
-
CVE-2026-5121 High
A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.
-
CVE-2026-4426 Medium
A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (D
-
CVE-2026-4424 High
A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication
-
CVE-2025-60753 Medium
An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).
-
CVE-2025-5916 Low
A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4 content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially leading to unpredictable program behavior, memory corruption, or a denial-of-service cond
-
CVE-2025-5917 Low
A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one' miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable program behavior, crashes, or in specific circumstances, could be leveraged as a building block for
-
CVE-2025-5918 Low
A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition.
About this page
This page gathers every public program listed under libarchive.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.