Netty bug bounty programs

Netty programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
NE Netty Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• NE

  Netty

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://netty.io

  Web

• Every other protocol codec shipped in the tree, including Redis, MQTT, STOMP, HAProxy protocol, SPDY, memcached, SMTP and the socks and haproxy proxy handlers

  Products and areas

• Native transports, epoll, kqueue and io_uring, and their JNI boundaries

  Products and areas

• The buffer allocator and the reference-counting model, where a leak or a double release is a memory-safety issue even on the JVM

  Products and areas

• The channel pipeline, event loops and handler lifecycle, including exception propagation and what happens to a connection when a handler throws

  Products and areas

• The codec-base machinery: cumulation, frame decoders and every place a length prefix from the wire drives an allocation

  Products and areas

• The DNS codec and resolver: transaction ID generation, response matching, bailiwick checks and cache behaviour

  Products and areas

• The HTTP/1.1 codec: request and response decoding, header validation, chunked handling, and the reconciliation of Content-Length against Transfer-Encoding

  Products and areas

• The HTTP/2 codec: frame handling, HPACK, stream state, flow control and the HTTP/1-to-HTTP/2 translation layer downstream frameworks depend on

  Products and areas

• The HTTP/3 and QUIC codecs, including QPACK encoding and decoding and the state each connection holds

  Products and areas

• The security policy takes reports through GitHub private vulnerability reporting under a ninety-day disclosure window and draws no boundary narrower than the Netty tree, so every codec and every transport in the repository is in bounds

  Products and areas

• The SSL and TLS layer in full, covering the JDK and OpenSSL-backed engines, certificate and hostname verification, and OCSP stapling validation

  Products and areas

• The WebSocket implementation from handshake through frame decoding, extension negotiation and continuation handling

  Products and areas

No target matches. Try part of a host name, such as the company name.