Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Open vSwitch bug bounty programs

openvswitch.org Updated

Open vSwitch runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
9
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Open vSwitch runs.

  • Open vSwitch

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

9 targets. 5 excluded.

  • https://www.openvswitch.org

    Web

  • Every tunnel encapsulation and decapsulation path, including VXLAN, Geneve, GRE and STT

    Products and areas

  • ovs-vswitchd itself, its bridge and port management, and the connection-tracking and NAT integration behind it

    Products and areas

  • OVSDB in full, covering the JSON-RPC protocol, ovsdb-server, and the schema and transaction handling that forms the configuration trust boundary for an entire fabric

    Products and areas

  • Reports go to [email protected], which runs the project's documented embargo process under Linux Foundation governance, against the Open vSwitch tree. OVN lives in a separate repository and sits outside that boundary

    Products and areas

  • The command-line and management utilities that parse operator-supplied and controller-supplied input

    Products and areas

  • The DPDK datapath, a large body of performance-tuned C that parses untrusted packets on the fast path

    Products and areas

  • The userspace datapath end to end: packet parsing in lib/flow.c and lib/packets.c, action execution, and the megaflow cache and revalidator where a flow-key confusion turns directly into a tenant-isolation failure

    Products and areas

  • The whole OpenFlow implementation in lib/ofp-*: message decoding, action and match handling, and everything a controller can drive

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 5

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Controller-side defects in OpenDaylight, ONOS or another SDN controller

  • Hypervisor escape claims that are really QEMU or KVM bugs reached through OVS

  • One-line fixes for non-exploitable crashes, which the Patch Rewards rules exclude

  • OVN (ovn-org/ovn), which is a separate repository with no OSS-Fuzz project directory of its own

  • The Linux kernel openvswitch datapath module, which belongs to the kernel scope row rather than to OVS userspace

Recent changes

Reward and scope changes across every Open vSwitch program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Open vSwitch products, from the NVD.

Search NVD
  • CVE-2023-3966 High

    A flaw was found in Open vSwitch where multiple versions are vulnerable to crafted Geneve packets, which may result in a denial of service and invalid memory accesses. Triggering this issue requires that hardware offloading via the netlink path is enabled.

  • CVE-2024-22563 High

    openvswitch 2.17.8 was discovered to contain a memory leak via the function xmalloc__ in openvswitch-2.17.8/lib/util.c.

  • CVE-2023-5366 High

    A flaw was found in Open vSwitch that allows ICMPv6 Neighbor Advertisement packets between virtual machines to bypass OpenFlow rules. This issue may allow a local attacker to create specially crafted packets with a modified or spoofed target IP address field that can redirect ICMPv6 traffic to arbitrary IP addresses.

  • CVE-2022-4337 Critical

    An out-of-bounds read in Organization Specific TLV was found in various versions of OpenvSwitch.

  • CVE-2022-4338 Critical

    An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch.

  • CVE-2019-25076 Medium

    The TSS (Tuple Space Search) algorithm in Open vSwitch 2.x through 2.17.2 and 3.0.0 allows remote attackers to cause a denial of service (delays of legitimate traffic) via crafted packet data that requires excessive evaluation time within the packet classification algorithm for the MegaFlow cache, aka a Tuple Space Explosion (TSE) attack.

  • CVE-2022-0669 Medium

    A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected number of fds as ancillary data to VHOST_USER_GET_INFLIGHT_FD / VHOST_USER_SET_INFLIGHT_FD messages that are not closed by the vhost-user slave. By sending such messages continuously, the vhost-user master exhausts available fd in the vhost-user slave process, leading to a denial of service.

  • CVE-2021-3905 High

    A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments.

About this page

This page gathers every public program listed under openvswitch.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.