- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 12
- Public CVEs
- 10
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
12 assets you may test, 5 excluded.
Web 1
- https://botan.randombit.net
Products and areas 11
- Every block cipher, stream cipher, hash, MAC and AEAD mode the library ships, including the tag verification paths
- Key derivation, password hashing and the PBKDF and KDF families
- The ASN.1 and BER decoder, which parses attacker-supplied structure before any signature has been checked
- The botan command line tool and the utility subcommands that parse files supplied by someone else
- The certificate store implementations and the platform trust store integrations that feed anchors into path validation
- The FFI layer and the Python bindings built on it, where a wrapper can lose a check the C++ API enforces
- The public key algorithms: RSA, the elliptic curve implementations, the signature and key agreement schemes, and the post-quantum algorithms Botan has added
- The published policy asks for any suspected security bug in Botan through the private GitHub flow or direct maintainer contact, qualified only by the project's own threat model. It draws no boundary narrower than the Botan tree
- The random number generators, their seeding, their reseeding policy and their behaviour across fork
- The TLS implementation on both sides, covering TLS 1.2 and TLS 1.3 handshake state, the record layer, session resumption, PSK handling and the callback surface embedders use to accept or reject a peer
- The X.509 implementation in full: certificate parsing, path building, trust anchor selection, name constraints, policy constraints, CRL handling and OCSP
Out of scope (5)
- Anything the project's published threat model puts outside its boundary; the policy directs reporters there before submitting
- Build configurations a consumer assembled that enable a module the project documents as deprecated or experimental
- Findings in a downstream project that vendors Botan, unless the defect is in Botan's own code
- Misuse of the API by a calling application where the documented usage is correct and safe
- Weaknesses in a standardised algorithm rather than in Botan's implementation of it
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
Report through GitHub's private security issue reporting flow on randombit/botan , which the policy names first and which is enabled on the repository
-
Read doc/threat_model.rst before writing the report. The policy points reporters there first, and a finding the threat model already disclaims will be closed on that basis
-
Botan is a build-configurable library. Name the modules enabled, the compiler and the target, because a module the default build omits changes whether a defect is reachable at all
-
Where the finding is in the TLS stack, state the version and the role, since Botan implements both client and server across TLS 1.2 and TLS 1.3
Not accepted
-
Weaknesses in a standardised algorithm rather than in Botan's implementation of it
-
Misuse of the API by a calling application where the documented usage is correct and safe
-
Findings in a downstream project that vendors Botan, unless the defect is in Botan's own code
-
Build configurations a consumer assembled that enable a module the project documents as deprecated or experimental
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
Sorona credits this project with 10 CVEs, 4 of them recent. The individual records appear here after the next sync.
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 4 Last 12 months 10 Lifetime Certificate validation 40 % TLS protocol state 25 % Parsing / ASN.1 20 % Denial of service 15 % Latest advisories Loading the feed Overview Botan is a general-purpose C++ cryptography toolkit, embedded in commercial C++ products where a vendor wanted a permissive licence and a full TLS stack in one dependency. It also provides the crypto backend inside SoftHSM. CVE-2026-34580 is the reference point: trust anchor confusion let certificate authentication be bypassed outright, and it landed on the same day as a second critical in the TLS 1.3 record layer. Cure53 has audited the library, an audit rather than a bounty, and the maintainer takes reports through GitHub advisories or direct contact with no reward available. sorona.xyz pays you directly on qualified, reproduced findings. In scope The published policy asks for any suspected security bug in Botan through the private GitHub flow or direct maintainer contact, qualified only by the project's own threat model. It draws no boundary narrower than the Botan tree The X.509 implementation in full: certificate parsing, path building, trust anchor selection, name constraints, policy constraints, CRL handling and OCSP The TLS implementation on both sides, covering TLS 1.2 and TLS 1.3 handshake state, the record layer, session resumption, PSK handling and the callback surface embedders use to accept or reject a peer The ASN.1 and BER decoder, which parses attacker-supplied structure before any signature has been checked Every block cipher, stream cipher, hash, MAC and AEAD mode the library ships, including the tag verification paths The public key algorithms: RSA, the elliptic curve implementations, the signature and key agreement schemes, and the post-quantum algorithms Botan has added Key derivation, password hashing and the PBKDF and KDF families The random number generators, their seeding, their reseeding policy and their behaviour across fork The FFI layer and the Python bindings built on it, where a wrapper can lose a check the C++ API enforces The certificate store implementations and the platform trust store integrations that feed anchors into path validation The botan command line tool and the utility subcommands that parse files supplied by someone else Out of scope Anything the project's published threat model puts outside its boundary; the policy directs reporters there before submitting Weaknesses in a standardised algorithm rather than in Botan's implementation of it Misuse of the API by a calling application where the documented usage is correct and safe Findings in a downstream project that vendors Botan, unless the defect is in Botan's own code Build configurations a consumer assembled that enable a module the project documents as deprecated or experimental Most-valued findings Certificate authentication bypass, the highest-severity class this project has produced. CVE-2026-34580 reached it through trust anchor confusion, letting a chain validate against an anchor it should never have matched Name constraint and path validation defects generally, the shape CVE-2026-32884 took, since a constraint that fails open turns a limited intermediate into an unlimited one TLS record and handshake sequencing defects. CVE-2026-34582 accepted out-of-sequence ApplicationData in TLS 1.3, which is a state machine failure at the point where confidentiality is supposed to begin Algorithmic complexity in the BER and ASN.1 decoders. CVE-2026-44378 was quadratic behaviour on indefinite-length encodings, reached before any authentication happens Memory corruption anywhere a peer, a certificate or a file drives parsing, which in a C++ crypto library linked into commercial products is a remote code execution primitive Timing and other side channel signals in the public key implementations or in AEAD tag verification, on a library that states constant-time behaviour as a goal Anything reaching the SoftHSM path, since Botan is one of SoftHSM's two crypto backends and a defect there becomes a key management defect Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report through GitHub's private security issue reporting flow on randombit/botan , which the policy names first and which is enabled on the repository Direct contact with the maintainer at [email protected] is the documented alternative, and the policy offers to exchange Signal identifiers for sensitive material Read doc/threat_model.rst before writing the report. The policy points reporters there first, and a finding the threat model already disclaims will be closed on that basis Botan is a build-configurable library. Name the modules enabled, the compiler and the target, because a module the default build omits changes whether a defect is reachable at all Where the finding is in the TLS stack, state the version and the role, since Botan implements both client and server across TLS 1.2 and TLS 1.3 No reward exists. The policy documents a process and offers no bounty of any kind, so there is nothing to negotiate on payment Disclosure Coordinated privately with the maintainer and published as a GitHub Security Advisory on randombit/botan alongside a patched release. The April 2026 pattern is the one to plan around: two criticals published on the same day, batched into one release. Downstream consumers who vendor Botan into commercial C++ products rebuild slowly, and SoftHSM sits directly on top of it, so hold the detail until the advisory and the release are both out. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability