NLnet Labs bug bounty programs
nlnetlabs.nl Updated
NLnet Labs runs three public programs: a Sorona bug bounty paying up to $1,500, a Sorona bug bounty paying up to $1,500 and a self-hosted disclosure program with no cash rewards.
- Top reward
- $1,500
- Sorona
- Programs
- 3
- 2 pay cash
- Targets in scope
- 19
- 3 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
3 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
NSD
Sorona · Pays the most of the 3 programs: up to $1,500.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
NSD
Sorona · Bug bounty |
– | – | – | $100 (highest) | $1,500 | Partial | – | – | Open |
|
Unbound
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | – | Open |
|
NLnet Labs
Self-hosted · Disclosure only |
– | – | – | – | No cash | – | – | – | Open |
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100 (highest)
- Safe harbor
- Partial
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
19 targets across all 3 programs, each listed once with the programs that cover it. 10 excluded.
-
DNSSEC handling for pre-signed zones, including NSEC and NSEC3 answering and the DNSSEC record types
Products and areas
Covered by NSD
-
DNSSEC validation in full, including the algorithmic-complexity surface where a valid-looking signed response costs the validator unbounded work
Products and areas
Covered by Unbound
-
EDNS handling, DNS cookies and the extension mechanisms attached to modern queries
Products and areas
Covered by NSD
-
Every transport the daemon terminates, DoT, DoH and DoQ included, each of which parses connection and framing state before any DNS logic runs
Products and areas
Covered by Unbound
-
NLnet Labs takes any defect in Unbound itself through GitHub private vulnerability reporting on NLnetLabs/unbound, subject to its published policy on machine-generated reports. Operator configuration sits outside that; the resolver daemon in full sits inside it
Products and areas
Covered by Unbound
-
NLnet Labs takes security reports for all of its software at a single entry point and declares nothing narrower than the project itself, so all of NSD is in
Products and areas
Covered by NSD
-
nsd-control and its control channel, including the certificate-based authentication on it
Products and areas
Covered by NSD
-
Query handling end to end: the wire-format parser, the answer construction path and every record type NSD serves
Products and areas
Covered by NSD
-
Rate limiting, response-rate limiting and the access-control lists deciding which peer may do what
Products and areas
Covered by NSD
-
Recursive resolution and cache handling end to end: cache poisoning, the NXNSAttack and unbounded-delegation class, and the aggressive-NSEC synthesis path where Unbound answers from something it derived
Products and areas
Covered by Unbound
-
The iterator module's referral and glue handling, the one place a hostile authoritative server gets to choose the input directly
Products and areas
Covered by Unbound
-
The process model: privilege dropping, chroot handling and the state shared between server processes
Products and areas
Covered by NSD
-
The zone-file parser and the zone compiler, which read operator data and data arriving over a transfer
Products and areas
Covered by NSD
-
unbound-control and the remote-control TLS channel, an authenticated administrative interface and therefore a privilege boundary
Products and areas
Covered by Unbound
-
XFR-over-TLS, including certificate verification on both ends, the surface that produced CVE-2026-12490
Products and areas
Covered by NSD
-
Zone transfer as primary and as secondary, covering AXFR, IXFR, NOTIFY and the TSIG authentication around them
Products and areas
Covered by NSD
No target matches. Try part of a host name, such as the company name.
Out of scope 10
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Configuration choices such as an allow-transfer entry broader than the operator intended
NSD
-
Distribution packaging and forks carrying local patches rather than upstream NSD
NSD
-
Downstream distribution patches and vendored forks, including those carried by pfSense and OPNsense, rather than defects in upstream Unbound
Unbound
-
NSD, the authoritative sibling, which is a separate project with no funding pathway of its own
Unbound
-
One-line patches that fix non-exploitable crashes, including crashes that only amount to resource exhaustion, which the Patch Rewards rules say will not generally be rewarded
Unbound
-
Operator misconfiguration such as open recursion or a missing access-control statement, which are deployment decisions
Unbound
-
Query-flood denial of service with no algorithmic defect behind it. Volume alone is not a bug
Unbound
-
Reflection and amplification against an authoritative server, which is a property of the protocol absent a defect in NSD's own rate limiting
NSD
-
Unbound, ldns, Routinator and Krill, which share the reporting address and are separate codebases
NSD
-
Zone content the operator published, including data that is simply wrong rather than a parser defect
NSD
Recent changes
Reward and scope changes across every NLnet Labs program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in NLnet Labs products, from the NVD.
-
CVE-2026-82717 High
In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the
-
CVE-2026-82717 High
In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the
-
CVE-2026-82720 Medium
NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with '--with-libnghttp2'. During failure code paths (i.e., RPZ drop query, jostle due to heavy traffic), a dropped DoH stream brings down the whole DoH session and does not account properly for other DoH streams in the same session. This leads to use-after-free in those
-
CVE-2026-85501 Medium
Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where the triple(Zone, Algo, KeyTag) matching mechanism introduces a sign
-
CVE-2026-82720 Medium
NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with '--with-libnghttp2'. During failure code paths (i.e., RPZ drop query, jostle due to heavy traffic), a dropped DoH stream brings down the whole DoH session and does not account properly for other DoH streams in the same session. This leads to use-after-free in those
-
CVE-2026-85501 Medium
Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where the triple(Zone, Algo, KeyTag) matching mechanism introduces a sign
-
CVE-2026-77955 Medium
In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is caused by the needed DS/DNSKEY asynchronous resolution that needs to happen before the ZO
-
CVE-2026-77860 Low
In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb (CVE-2024-33655). A malicious actor can exploit this by controlling an authoritative zone with short TTL, so cached entries expire quickly. Ea
About this page
This page gathers every public program listed under nlnetlabs.nl: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.