sorona.xyz bug bounty programs
libssh.org Updated
Sorona.xyz runs one public program: a Sorona bug bounty paying up to $1,500.
- Top reward
- $1,500
- Sorona
- Programs
- 1
- 1 pays cash
- Targets in scope
- 9
- 2 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program sorona.xyz runs.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
libssh
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | – | Open |
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
9 targets. 6 excluded.
-
https://www.libssh.org
Web
-
[email protected] takes any not-yet-public security issue in libssh, and the maintainers fix privately, ship a numbered release and publish an advisory. Both halves of the library are in: the client implementation and the server implementation
Products and areas
-
Key, certificate and known_hosts parsing, and the host-key verification callbacks that decide whether a client trusts the server it reached
Products and areas
-
Memory safety in the transport layer, where a length or padding value taken off the wire drives a copy, a MAC check or a decompression step
Products and areas
-
Pre-authentication packet handling on both sides: banner and version exchange, binary packet framing, and key exchange before any credential has been checked
Products and areas
-
The authentication methods in full, covering public key, keyboard-interactive, password and GSSAPI, including the paths that report success or failure back to the caller
Products and areas
-
The callback and options API surface, where an embedding application supplies its own authentication handlers and libssh decides what to do with their answers
Products and areas
-
The channel, SFTP and port-forwarding layers, where a peer controls sizes, request identifiers and filenames after the session is up
Products and areas
-
The server-side authentication state machine, where a client-supplied message sequence can drive a session into an authenticated state without valid credentials
Products and areas
No target matches. Try part of a host name, such as the company name.
Out of scope 6
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Application-side API misuse: an embedding application that ignores a return value or wires its own authentication callback to always succeed
-
Defects that actually live in a linked crypto backend such as OpenSSL, mbedTLS or libgcrypt rather than in libssh
-
libssh2, which is a different project with a different codebase despite the name, and has its own upstream and its own scope row
-
One-line fixes for non-exploitable crashes, which the Patch Rewards rules will not reward, including crashes that come from resource exhaustion
-
OpenSSH, which is unrelated code and sits on its own Tier 1 row
-
Patches the maintainers decline, patches under one month or over twelve months old, and anything past three submissions a person a month
Recent changes
Reward and scope changes across every sorona.xyz program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in sorona.xyz products, from the NVD.
-
CVE-2026-59849 Low
A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service.
-
CVE-2026-59850 Medium
A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions.
-
CVE-2026-59851 High
A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.
-
CVE-2026-59847 Medium
A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection.
-
CVE-2026-59848 Medium
A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.
-
CVE-2026-59846 Low
A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.
-
CVE-2026-59842 Low
A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation, leading to an out-of-bounds heap read. This could allow a remote unauthenticated attacker to disclose small amounts of server memory.
-
CVE-2026-59843 Medium
A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service.
About this page
This page gathers every public program listed under libssh.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.