sorona.xyz bug bounty programs
open62541.org Updated
Sorona.xyz runs one public program: a Sorona bug bounty paying up to $1,500.
- Top reward
- $1,500
- Sorona
- Programs
- 1
- 1 pays cash
- Targets in scope
- 9
- 2 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program sorona.xyz runs.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
open62541
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | – | Open |
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
9 targets. 5 excluded.
-
https://open62541.org
Web
-
PubSub over UDP and MQTT, together with the JSON encoding path used alongside the binary one
Products and areas
-
Reports go to the maintainer list at [email protected], against the open62541 stack itself. Defects in the TLS library underneath belong upstream; what counts here is open62541's own use of it
Products and areas
-
The client implementation, which parses responses from a server it does not control
Products and areas
-
The complete server implementation, covering the session and subscription lifecycle, MonitoredItems, method calls and every service the server exposes
Products and areas
-
The Nodestore and the address space, including the browse and query handlers an unauthenticated client can drive
Products and areas
-
The transport and channel layer in full: TCP connection handling, SecureChannel establishment and renewal, message chunking and reassembly, and message-size limit enforcement
Products and areas
-
The whole binary encoding and decoding layer around UA_decodeBinary, which is both the main fuzz target and the main remotely reachable surface
Products and areas
-
The whole security layer: certificate validation, the trust-list handling behind it, and the security policies built on mbedTLS or OpenSSL (Basic256Sha256, Aes128Sha256RsaOaep)
Products and areas
No target matches. Try part of a host name, such as the company name.
Out of scope 5
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Configuration and deployment problems in a product that embeds open62541, as distinct from the stack's own code
-
Crash-only one-liners, which Google explicitly declines to reward on the patch rail
-
Defects in the underlying TLS library itself rather than in open62541's use of it
-
For the Google money specifically, anything reported but never patched upstream: that pathway pays only on a merge
-
Patches over twelve months old, which Patch Rewards will not consider
Recent changes
Reward and scope changes across every sorona.xyz program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in sorona.xyz products, from the NVD.
-
CVE-2022-25761 High
The package open62541/open62541 before 1.2.5, from 1.3-rc1 and before 1.3.1 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks (e.g. 2GB each) without sending the Final closing chunk.
-
CVE-2020-36429 Medium
Variant_encodeJson in open62541 1.x before 1.0.4 has an out-of-bounds write for a large recursion depth.
About this page
This page gathers every public program listed under open62541.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.