sorona.xyz bug bounty programs
python.org Updated
Sorona.xyz runs two public programs: a Sorona bug bounty paying up to $1,500 and a self-hosted bug bounty.
- Top reward
- $1,500
- Sorona
- Programs
- 2
- 2 pay cash
- Targets in scope
- 9
- 2 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Python (CPython)
Sorona · Pays the most of the 2 programs: up to $1,500.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Python (CPython)
Sorona · Bug bounty |
– | – | – | $100 (highest) | $1,500 | Partial | – | – | Open |
|
Python
Self-hosted · Bug bounty |
– | – | – | – | Not published | None | – | – | Open |
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100 (highest)
- Safe harbor
- Partial
-
- Safe harbor
- None
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
9 targets across all 2 programs, each listed once with the programs that cover it. 7 excluded.
-
Archive and compression handling (zipfile, tarfile, gzip, bz2, lzma) for path traversal, symlink extraction, and decompression bombs, plus json, cgi, wsgiref, ipaddress, hashlib, and hmac.
Products and areas
Covered by Sorona
-
C-level accelerator and extension modules shipped with CPython (_ssl, _hashlib, _socket, _pickle, _json, _elementtree/expat, _ctypes, _sqlite3, and the zlib bindings) for memory-safety defects.
Products and areas
Covered by Sorona
-
pip as distributed via PyPI, which the Python Security Response Team accepts alongside CPython.
Products and areas
Covered by Sorona
-
Platform-specific issues only where the platform meets a PEP 11 support tier.
Products and areas
Covered by Sorona
-
Standard-library modules that parse or handle untrusted input: http, http.client, http.server, urllib, urllib.parse, email, ssl, ftplib, and smtplib.
Products and areas
Covered by Sorona
-
String, bytes, and codec handling, plus path handling (os.path, pathlib) and subprocess argument or quoting handling where it enables injection beyond documented behavior.
Products and areas
Covered by Sorona
-
The CPython interpreter core: the eval loop, bytecode compiler, memory management, garbage collector, and object model, where a real-world exploitable flaw exists.
Products and areas
Covered by Sorona
-
XML parsers (xml.sax, xml.dom, xml.etree.ElementTree, xml.parsers.expat) for XXE, entity-expansion, and billion-laughs style bugs.
Products and areas
Covered by Sorona
No target matches. Try part of a host name, such as the company name.
Out of scope 7
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Bugs reachable only through code, configurations, or deployments unlikely to occur in a real production program. Severity is scored from expected use, not the worst case.
Sorona
-
Documented dangerous APIs used as designed: pickle, marshal, shelve, eval, exec, and ctypes, all documented to execute or expose arbitrary code or memory.
Sorona
-
Experimental or provisional features, even in a stable release, and pre-release (alpha, beta, RC) or in-development code.
Sorona
-
Flaws in bundled third-party dependencies such as zlib, OpenSSL, Tcl/Tk, or libexpat, unless CPython's own usage undermines their safe use.
Sorona
-
Python versions past end-of-life, since only releases in bugfix or security status are accepted.
Sorona
-
Third-party redistributions of Python or pip and PyPI package vulnerabilities, plus issues that require the attacker to already control launch arguments, environment variables, or on-disk files.
Sorona
-
Unhandled exceptions treated on their own as an expected part of control flow.
Sorona
Recent changes
Reward and scope changes across every sorona.xyz program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in sorona.xyz products, from the NVD.
-
CVE-2026-112899 Medium
Pillow is a Python imaging library. In versions 2.3.0 through 12.3.0, EPS rendering does not validate the scaled image dimensions before invoking Ghostscript. Applications that process untrusted EPS or PostScript files using an application-selected scale greater than one can incur excessive Ghostscript CPU and temporary disk consumption. In versions with decompression-bomb protection, the scaled o
-
CVE-2026-112902 High
Pillow is a Python imaging library. In versions through 12.3.0, the libtiff TIFF encoder can pass arguments to TIFFSetField() that do not match libtiff’s definition of the corresponding tag. When an application saves attacker-controlled image metadata through this encoder, crafted tag values can cause invalid memory reads, copying process memory into the encoded output or crashing the process. App
-
CVE-2026-112899 Medium
Pillow is a Python imaging library. In versions 2.3.0 through 12.3.0, EPS rendering does not validate the scaled image dimensions before invoking Ghostscript. Applications that process untrusted EPS or PostScript files using an application-selected scale greater than one can incur excessive Ghostscript CPU and temporary disk consumption. In versions with decompression-bomb protection, the scaled o
-
CVE-2026-112902 High
Pillow is a Python imaging library. In versions through 12.3.0, the libtiff TIFF encoder can pass arguments to TIFFSetField() that do not match libtiff’s definition of the corresponding tag. When an application saves attacker-controlled image metadata through this encoder, crafted tag values can cause invalid memory reads, copying process memory into the encoded output or crashing the process. App
-
CVE-2026-114501 Medium
Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im->blocks[0].ptr even when PILLOW_ALIGNMENT makes aligned_linesize include row padding or an aligned offset before the first row. The resulting Arrow buffer can include uninitialized padding, bytes preceding the first row, or stale heap contents from prev
-
CVE-2026-114501 Medium
Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im->blocks[0].ptr even when PILLOW_ALIGNMENT makes aligned_linesize include row padding or an aligned offset before the first row. The resulting Arrow buffer can include uninitialized padding, bytes preceding the first row, or stale heap contents from prev
-
CVE-2026-96641 Medium
Pillow is a Python imaging library. Prior to 13.0.0, PILfont text-width accumulation in src/_imaging.c checks positive glyph advances against INT_MAX but does not check negative advances against INT_MIN. Repeating a signed 16-bit advance of -32768 can therefore execute a signed C integer overflow in xsize += dx, producing a large positive width from a negative mathematical result. Applications tha
-
CVE-2026-96642 High
Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consumes a full CPU core, and never returns. TarIO is reached only when an application directly uses PIL.TarI
About this page
This page gathers every public program listed under python.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.