Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

sorona.xyz bug bounty programs

sourceware.org Updated

Sorona.xyz runs two public programs: a Sorona bug bounty paying up to $1,500 and a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
2
2 pay cash
Targets in scope
19
2 types, deduplicated
Last change
None yet
Tracked since Nov 2026

Where to report

2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.

Start here

glibc

Sorona · Pays the most of the 2 programs: up to $1,500.
  • glibc

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100 (highest)
    Safe harbor
    Partial
  • GDB

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

19 targets across all 2 programs, each listed once with the programs that cover it. 13 excluded.

  • https://sourceware.org/gdb

    Web

    Covered by GDB

  • https://sourceware.org/glibc

    Web

    Covered by glibc

  • alloca and variable-length arrays where an untrusted-influenced size can drive unbounded stack growth, plus deep-recursion paths that can exhaust the stack

    Products and areas

    Covered by glibc

  • Any path that can start execution of the debuggee without a user command, including anything auto-loaded when a file is opened

    Products and areas

    Covered by GDB

  • Character-set and iconv conversion and the gconv modules when parsing untrusted byte sequences

    Products and areas

    Covered by glibc

  • Everything GDB parses that it did not produce: ELF binaries, separate debug info files, core dumps, and the DWARF readers underneath all of them

    Products and areas

    Covered by GDB

  • gcore and gdb-add-index, the auxiliary tools shipped alongside

    Products and areas

    Covered by GDB

  • GDB's own handling of a misbehaving remote stub. The policy puts third-party stubs out of scope but keeps GDB's reaction to one in scope

    Products and areas

    Covered by GDB

  • GDB's SECURITY.txt states its accepted classes outright: any bug in GDB or gdbserver that results in an unexpected crossing of a privilege boundary, and any bug that results in execution of the program being debugged without a user command triggering it. Both cover the whole tree, gdb and gdbserver alike

    Products and areas

    Covered by GDB

  • gdbserver end to end, including the remote protocol handling on the GDB side of the connection

    Products and areas

    Covered by GDB

  • nscd, the name service cache daemon, where crashes are generally security bugs unless only reachable from a trusted data source (DNS untrusted; NIS and LDAP treated as trusted)

    Products and areas

    Covered by glibc

  • setuid and privilege-sensitive code paths and environment handling inside privileged programs

    Products and areas

    Covered by glibc

  • The debuginfod client path, enabled by default in modern GDB, where debug data arrives over the network from a server the developer never audited

    Products and areas

    Covered by GDB

  • The dynamic loader (ld.so / ld-linux): module loading, symbol resolution, and handling of environment variables that influence loading in setuid or otherwise privileged contexts

    Products and areas

    Covered by glibc

  • The extension script machinery, to the extent GDB acts on data carried by the file under inspection rather than on the user's own configuration

    Products and areas

    Covered by GDB

  • The malloc/free allocator when corruption is reachable from untrusted-influenced data, and string and buffer routines where untrusted data reaches the buffer

    Products and areas

    Covered by glibc

  • The name-resolution and NSS stack: the resolver (libresolv, getaddrinfo, gethostbyname), DNS response parsing where DNS is treated as untrusted input, and NSS module dispatch

    Products and areas

    Covered by glibc

  • The printf and scanf family and format-string processing when the data could plausibly come from an untrusted source

    Products and areas

    Covered by glibc

  • The regular-expression engine (regcomp, regexec), subject to the crafted-pattern carve-outs below

    Products and areas

    Covered by glibc

No target matches. Try part of a host name, such as the company name.

Out of scope 13

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Asynchronous I/O and thread-cancellation crashes or resource leaks unless a real application, not a synthetic test case, has genuine security exposure

    glibc

  • Bugs that merely destabilize the whole system without any practical exploitation path, which are not classed as security issues

    glibc

  • Defects in the program being debugged rather than in GDB

    GDB

  • Failure of a post-exploitation hardening mitigation to block a separate bug, which is not itself a vulnerability

    glibc

  • Known undefined behaviour from a malformed program under inspection. The policy accepts these reports but marks them explicitly low priority absent a demonstrated boundary breach

    GDB

  • ldd run against untrusted or crafted executables, which is outside its intended use

    glibc

  • nscd crashes reachable only from a trusted data source such as NIS or LDAP rather than DNS

    glibc

  • Regex crafted-pattern behavior treated as ordinary bugs rather than security: memory exhaustion, quadratic or exponential (catastrophic backtracking) runtime, and stack overflow from recursion while processing a crafted pattern (crashes, infinite loops, buffer overflows and overreads, memory leaks, and other undefined behavior in regex remain in scope)

    glibc

  • Reports filed on the public Sourceware Bugzilla for an issue that is not yet public

    GDB

  • The contents of user and system configuration files and plugins, which the policy treats as trusted input

    GDB

  • The GDB to gdbserver connection itself. The policy calls it insecure by design and places responsibility for securing it on the user

    GDB

  • Third-party remote stubs, though a GDB defect triggered by a misbehaving stub remains in scope

    GDB

  • wordexp denial of service from crafted patterns, which is not treated as a security issue

    glibc

Recent changes

Reward and scope changes across every sorona.xyz program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

About this page

This page gathers every public program listed under sourceware.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.