Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Zephyr bug bounty programs

zephyrproject.org Updated

Zephyr runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
13
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Zephyr runs.

  • Zephyr RTOS

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial
    First response
    7 days promised

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

13 targets. 6 excluded.

  • https://www.zephyrproject.org

    Web

  • The 802.15.4, Thread, Wi-Fi and OpenThread integration paths, all of which parse frames off the air

    Products and areas

  • The Bluetooth stack in full: the controller, the host, GAP and GATT, SMP pairing, L2CAP, and the LE Audio profiles including BAP, CAP and the broadcast assistant

    Products and areas

  • The crypto subsystem and the TLS and DTLS integration, including PSA Crypto

    Products and areas

  • The device driver tree in full, covering UART, USB controllers, SPI, I2C, CAN, Ethernet and the sensor drivers, across every vendor's silicon in the repository

    Products and areas

  • The device firmware upgrade subsystem and its integration with the bootloader, which decides what image a device runs next

    Products and areas

  • The IP networking stack, covering IPv4 and IPv6, TCP, UDP, the socket layer, and the in-tree protocol clients such as DNS, DHCP, SNTP, MQTT, CoAP, LwM2M and HTTP

    Products and areas

  • The kernel: scheduling, threads, work queues, timers, the IPC primitives and the memory allocators

    Products and areas

  • The policy asks for any vulnerability through a draft advisory on the Zephyr repository or the project security address, and it sets out a triage state machine and a backport policy rather than a narrow asset list. The whole Zephyr tree is the declared target

    Products and areas

  • The settings, storage and filesystem subsystems, along with the flash map and non-volatile storage layers beneath them

    Products and areas

  • The shell and logging subsystems, and anything else that parses text a remote party supplied

    Products and areas

  • USB device and host stacks, including every class driver that reads descriptors from the other end of the cable

    Products and areas

  • User mode and the system call boundary, plus the memory domain and MPU configuration meant to keep a user thread out of kernel memory

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Application code written against Zephyr that misuses an API in a way the documentation warns against

  • Board and configuration choices an integrator made, including building without user mode or leaving the shell enabled on a production device

  • MCUboot itself, a separate project with its own repository and its own policy

  • Out-of-tree drivers, modules and board ports

  • Physical attacks on a device an attacker already holds, including debug-port readout of flash

  • Silicon vendor SDK forks such as Nordic's nRF Connect SDK, where a defect that exists only in the vendor's own additions belongs to that vendor

Recent changes

Reward and scope changes across every Zephyr program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Zephyr products, from the NVD.

Search NVD
  • CVE-2026-18417 Medium

    The native BSD-socket layer recorded a pending asynchronous socket error by type-punning it into struct net_context's void user_data field (ctx->user_data = INT_TO_POINTER(-status) in zsock_accepted_cb(), zsock_received_cb(), zsock_connected_cb() and zsock_close_ctx() in subsys/net/lib/sockets/sockets_inet.c), reading it back with POINTER_TO_INT(). That same field is owned by the network stack for

  • CVE-2026-18746 Medium

    parse_write_op() in subsys/net/lib/lwm2m/lwm2m_message_handling.c handles inbound CoAP WRITE/CREATE requests that carry a Block1 option. For the first block of a transfer it called init_block_ctx() and then immediately stored the peer-selected block size with block_ctx->ctx.block_size = block_size before inspecting the return code. init_block_ctx() sets the caller's pointer to NULL and returns -EN

  • CVE-2026-18747 Medium

    The MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit packet length from it, verifies a CRC and then unconditionally strips the trailing CRC with rx_ctxt->nb->len -= 2U; in mcumgr_serial_process_frag() (subsys/mgmt/mcumgr/transport/src/serial_util.c). mcumgr_serial_extract_len() accepted any declared length, including 0 and 1, and a packet declaring length 0 passes the check

  • CVE-2026-18416 Low

    The CoAP link-format helper match_path_uri() in subsys/net/lib/coap/coap_link_format.c compares a registered resource path against the URI carried in a Uri-Query href= option. That URI is not NUL terminated, but the inner character loop advanced its index k once per path character without ever testing it against the option length len. When a registered path segment is longer than the supplied URI

  • CVE-2026-16513 High

    The userspace verifier z_vrfy_rtio_sqe_copy_in_get_handles() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0) validated the RTIO object handle and the sqes input array, but not the handle out-parameter. On the first loop iteration it executed *handle = sqe, storing the kernel address of the newly acquired submission-queue entry through a pointer taken verbatim from user m

  • CVE-2026-18413 High

    The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size field of struct adc_sequence in include/zephyr/drivers/adc.h documents that "the driver must ensure that samples are not written beyond the limit and it must return an error if the buffer turns out to be not large enough". The NXP MCUX LPADC driver did not honour that contract. mcu

  • CVE-2026-18414 High

    The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size field of struct adc_sequence in include/zephyr/drivers/adc.h documents that "the driver must ensure that samples are not written beyond the limit and it must return an error if the buffer turns out to be not large enough". The ADI MAX32 driver did not honour that contract. start_re

  • CVE-2026-18415 Medium

    ieee802154_send() in subsys/net/l2/ieee802154/ieee802154.c copies the outgoing packet into a single fixed 125-byte transmit buffer (tx_frame_buf_pool, sized IEEE802154_MTU). In builds with CONFIG_NET_L2_IEEE802154_FRAGMENT enabled (the default whenever CONFIG_NET_6LO is set), the branch taken when 6LoWPAN fragmentation is not required performed an unchecked net_buf_add_mem(frame_buf, pkt_buf->data

About this page

This page gathers every public program listed under zephyrproject.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.