libcoap bug bounty programs
libcoap.net Updated
Libcoap runs one public program: a Sorona bug bounty paying up to $1,500.
- Top reward
- $1,500
- Sorona
- Programs
- 1
- 1 pays cash
- Targets in scope
- 8
- 2 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program libcoap runs.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
libcoap
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | – | Open |
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
8 targets. 6 excluded.
-
https://libcoap.net
Web
-
Block-wise transfer (Block1/Block2) reassembly, where an attacker controls both the fragment sizes and their arrival order
Products and areas
-
CoAP message parsing in full: the option parser, token handling and the header walk that runs on every datagram before anything else in the library sees it
Products and areas
-
Observe subscription state handling and resource registration, where a peer can drive the server's own bookkeeping
Products and areas
-
OSCORE (Object Security for Constrained RESTful Environments) processing, the end-to-end protection layer that is meant to survive an untrusted proxy
Products and areas
-
Proxy and multicast handling, where one crafted message can be amplified or relayed into a network the sender could not reach directly
Products and areas
-
The DTLS integration layers against OpenSSL, GnuTLS, Mbed TLS and TinyDTLS, including session resumption, which is libcoap's own glue rather than the TLS libraries beneath it
Products and areas
-
The project takes security reports through the address in its SECURITY.md and asks for a working reproducer; a report that merely suggests a file may be vulnerable under certain conditions is refused. Nothing narrower than the library itself is carved out, and everything below is inside it
Products and areas
No target matches. Try part of a host name, such as the company name.
Out of scope 6
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Crash-only one-liners: a fix that silences a non-exploitable crash without closing a class of defect does not clear the top of the reward ladder
-
Patches over twelve months old, which fall outside the program's age window
-
Patches the libcoap maintainers decline, since the reward is contingent on the merge rather than on the idea
-
Reports that merely suggest a file may be vulnerable under certain conditions, which the maintainers reject outright
-
The underlying TLS libraries themselves. OpenSSL, GnuTLS, Mbed TLS and TinyDTLS all have their own payers, and only libcoap's integration code is in scope here
-
Vulnerability reports with no merged patch behind them, which earn nothing on Google's rail
Recent changes
Reward and scope changes across every libcoap program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in libcoap products, from the NVD.
-
CVE-2026-29013 High
libcoap contains out-of-bounds read vulnerabilities in OSCORE Appendix B.2 CBOR unwrap handling where get_byte_inc() in src/oscore/oscore_cbor.c relies solely on assert() for bounds checking, which is removed in release builds compiled with NDEBUG. Attackers can send crafted CoAP requests with malformed OSCORE options or responses during OSCORE negotiation to trigger out-of-bounds reads during CBO
-
CVE-2025-34468 High
libcoap versions up to and including 4.3.5, prior to commit 30db3ea, contain a stack-based buffer overflow in address resolution when attacker-controlled hostname data is copied into a fixed 256-byte stack buffer without proper bounds checking. A remote attacker can trigger a crash and potentially achieve remote code execution depending on compiler options and runtime memory protections. Exploitat
-
CVE-2025-59391 Medium
A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before release-4.3.5-patches. An out-of-bounds read may occur when parsing certain configuration values, allowing an attacker to infer or read memory beyond string boundaries in the .rodata section. This could potentially lead to information disclosure or denial of service.
-
CVE-2025-65498 Medium
NULL pointer dereference in coap_dtls_generate_cookie() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS handshake that triggers SSL_get_SSL_CTX() to return NULL.
-
CVE-2025-65499 Medium
Array index error in tls_verify_call_back() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS handshake that triggers SSL_get_ex_data_X509_STORE_CTX_idx() to return -1.
-
CVE-2025-65500 Medium
NULL pointer dereference in coap_dtls_generate_cookie() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS handshake that triggers SSL_get_SSL_CTX() to return NULL.
-
CVE-2025-65501 Medium
Null pointer dereference in coap_dtls_info_callback() in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a DTLS handshake where SSL_get_app_data() returns NULL.
-
CVE-2025-65493 High
NULL pointer dereference in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS/TLS connection that triggers BIO_get_data() to return NULL.
About this page
This page gathers every public program listed under libcoap.net: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.