Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

sorona.xyz bug bounty programs

vllm.ai Updated

Sorona.xyz runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
14
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program sorona.xyz runs.

  • vLLM

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

14 targets. 6 excluded.

  • https://docs.vllm.ai

    Web

  • LoRA adapter loading and the multi-adapter serving path, including where an adapter is fetched from

    Products and areas

  • Model loading across safetensors, GGUF and PyTorch checkpoint formats, along with the remote code execution flag on models fetched from a hub

    Products and areas

  • Multimodal input handling for image, video and audio models, which decodes attacker-supplied media in process

    Products and areas

  • SECURITY.md routes reports to the vulnerability management team through GitHub private advisory reporting, and the published process declares no boundary narrower than the project. Everything below sits inside that

    Products and areas

  • Speculative decoding, prefix-cache-aware routing and the disaggregated prefill paths

    Products and areas

  • The CLI, the entrypoints and the configuration parsing in front of the engine

    Products and areas

  • The distributed execution layer: the worker-to-worker transport, the collective communication backend and every control channel between engine processes

    Products and areas

  • The KV cache, prefix caching and any cross-request state that persists between one caller's request and another's

    Products and areas

  • The metrics, health and server info endpoints and what each exposes about loaded models and adapters

    Products and areas

  • The OpenAI-compatible API server: the chat, completions, embeddings, tokenisation and pooling endpoints, and the request parsing and validation behind each

    Products and areas

  • The Ray and Kubernetes integrations the project ships, and the plugin and custom executor interfaces

    Products and areas

  • The tokenizer and chat template rendering, which evaluates a Jinja template that arrives with the model

    Products and areas

  • Tool calling, structured output and guided decoding, covering the grammar and schema parsing each performs on request input

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • A deployment deliberately run with remote code execution enabled against an untrusted model

  • Model weights and their provenance, which the operator chooses to trust or not

  • Prompt injection, jailbreaks and output content, which are model behaviour rather than engine defects

  • PyTorch, transformers, CUDA and other upstream dependencies, unless vLLM's own use of them is what makes the defect reachable

  • Ray as a project, which has its own security process and its own paid huntr history

  • Resource consumption within limits the operator configured

Recent changes

Reward and scope changes across every sorona.xyz program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in sorona.xyz products, from the NVD.

Search NVD
  • CVE-2026-115914 Medium

    vLLM is an inference and serving engine for large language models. From 0.11.1 until 0.32.0, the DeepSeek-OCR, DeepSeek-OCR-2, and Unlimited-OCR image path allows a remote client that can reach the OpenAI-compatible API to submit a legal image whose normalized pixels sum to zero when that image is alone in its per-step encoder batch. _parse_and_validate_image_input returns no embedding, embed_mult

  • CVE-2026-115915 High

    vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.open(BytesIO(data)) without restricting decoder selection, and the MIME label does not constrain the selected format. Image-capable request paths through parse_image() and fetch_image() can therefore dispatch an EPS payload to host componen

  • CVE-2026-115916 Medium

    vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes max_token_id with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact multiple-of-64 vocabulary, VocabParallelEmbedding.forward does not mask that value before F.embedding uses it

  • CVE-2026-115917 Low

    vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowed_origins set to a wildcard by default. A malicious web page can use a victim's browser to reach an unauthenticated vLLM server on localhost, an internal network, or a VPN, call endpoints including GET /v1/models and POST /v1/chat/completio

  • CVE-2026-115918 Medium

    vLLM is an inference and serving engine for large language models. From 0.16.0 until 0.32.0, the /v1/responses endpoint allows an authenticated caller to place an attacker-controlled template in chat_template_kwargs[chat_template] when no server template is configured. ChatParams.get_apply_chat_template_kwargs() preserves that value without enforcing trust_request_chat_template, so the request can

  • CVE-2026-115911 Medium

    vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a request chat template when no server-side --chat-template is configured, or a malicious model repository can provide a template that is compiled and rendered by tokenizer.apply_chat_template() without a wall-clock timeout, output-size limit, or iteration bound. Rendering

  • CVE-2026-115912 High

    vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated caller can place forged shared-memory address and monotonic_id values in public multimodal features.kwargs_data. In scale-out deployments with shared-memory multimodal caching enabled, workers trust those values and pass attacker-selected bytes to pickle.loads(), allowing arbitrary Python execution

  • CVE-2026-115913 Medium

    vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the Phi-4 multimodal audio encoder in phi4mm_audio.py and phi4mm_utils.py uses eager attention by default, allowing a remote client to submit one legal long audio clip that causes MultiHeadedAttention.forward_attention to materialize and retain full attention matrices in self.attn. The scaled dot-product attention

About this page

This page gathers every public program listed under vllm.ai: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.