Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

sorona.xyz bug bounty programs

squid-cache.org Updated

Sorona.xyz runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
15
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program sorona.xyz runs.

  • Squid

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial
    First response
    2 days promised

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

15 targets. 6 excluded.

  • https://www.squid-cache.org

    Web

  • ESI processing and the assembly of edge-included fragments

    Products and areas

  • External authentication and the helper protocol, covering basic, digest, NTLM and negotiate helpers and the data passed across that boundary

    Products and areas

  • HTTP request and response parsing in full, covering headers, chunked encoding, absolute-form and origin-form request targets, and the reconciliation of framing headers

    Products and areas

  • SSL-bump, dynamic certificate generation and the whole TLS interception path, including how a certificate decision is made and cached

    Products and areas

  • The ACL engine and every ACL type, since that is the machinery enforcing the network's actual policy

    Products and areas

  • The cache manager interface and the SNMP agent, both reachable over the network

    Products and areas

  • The cache: key derivation, storage, revalidation, variant selection, and every path by which one client's stored response could reach another client

    Products and areas

  • The cache_digest implementation and the digest exchange with peers

    Products and areas

  • The FTP gateway and the other non-HTTP gateways compiled into the daemon

    Products and areas

  • The ICAP and eCAP clients used for content adaptation, and the trust placed in an adaptation service's response

    Products and areas

  • The logging path and every point where attacker-controlled data reaches an access log or a store log

    Products and areas

  • The peer protocols, ICP and HTCP, which accept traffic from other cache nodes on the network rather than from clients

    Products and areas

  • The SECURITY.md asks for security reports on the closed squid-bugs list and holds them in confidence until the impact is established. It draws no boundary narrower than Squid itself

    Products and areas

  • URN handling and the other legacy URI schemes still compiled in by default

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Configurations that leave the proxy open to the internet, which is an operator decision rather than a Squid defect

  • Denial of service proportional to request volume with no amplification factor

  • Distribution patches and packaging rather than upstream Squid

  • Reports filed as public GitHub issues rather than on the closed list

  • Third-party helper programs that are not shipped in the Squid tree

  • Upstream libraries such as OpenSSL, unless Squid's own use of them is what makes the issue reachable

Recent changes

Reward and scope changes across every sorona.xyz program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in sorona.xyz products, from the NVD.

Search NVD
  • CVE-2026-47729 Medium

    Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read: when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename, parsing was not restricted to the input buffer, so a trusted client accessing a misbe

  • CVE-2026-50012 Medium

    Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache digest reply handling (peerDigestSwapInMask in src/peer_digest.cc), Squid is vulnerable to a heap-based buffer overflow: a cache digest's on-the-wire size may be larger than the mask_size declared within the digest, so a trusted peer sending a maliciously crafted reply to a cache_digest request mes

  • CVE-2026-33515 Medium

    Squid is a caching proxy for the Web. Prior to version 7.5, due to improper input validation, Squid is vulnerable to out of bounds read when handling ICP traffic. This problem allows a remote attacker to receive small amounts of memory potentially containing sensitive information when responding with errors to invalid ICP requests. This attack is limited to Squid deployments that explicitly enable

  • CVE-2026-33526 Critical

    Squid is a caching proxy for the Web. Prior to version 7.5, due to heap Use-After-Free, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non

  • CVE-2026-32748 High

    Squid is a caching proxy for the Web. Prior to version 7.5, due to premature release of resource during expected lifetime and heap Use-After-Free bugs, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid de

  • CVE-2025-62168 Critical

    Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. The vulnerability allows a script to bypass browser security protections and learn the credentials a trusted client uses to authenticate. This potentially allows a remote client to identify security tokens or credentials used int

  • CVE-2025-59362 Medium

    Squid through 7.1 mishandles ASN.1 encoding of long SNMP OIDs. This occurs in asn_build_objid in lib/snmplib/asn1.c.

  • CVE-2025-54574 Critical

    Squid is a caching proxy for the Web. In versions 6.3 and below, Squid is vulnerable to a heap buffer overflow and possible remote code execution attack when processing URN due to incorrect buffer management. This has been fixed in version 6.4. To work around this issue, disable URN access permissions.

About this page

This page gathers every public program listed under squid-cache.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.