CacheLib

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Minimum award, where Meta pays a bounty at all │ $500 │ $625 Maximum: discretionary, no published ceiling for open source │ not published │ not published Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime Memory safety 50 % Denial of service 20 % Info disclosure 20 % Parsing/validation 5 % Latest advisories Loading the feed Overview CacheLib is the C++ caching engine behind Meta's CDN, its key-value caches and its social-graph caches. External adoption is modest; what makes it interesting is its shape. It manages very large hybrid DRAM-and-flash caches with hand-rolled allocators, so its bug surface is allocator and serialisation memory safety operating on data that arrived from other services rather than from a trusted local caller: half the expected bug distribution here is memory safety and a fifth is information disclosure, which is what a cache tier's failure modes look like. It is also the clean positive control for Meta's org-membership rule: facebookincubator/CacheLib now redirects to facebook/CacheLib , and because both organisations sit on the scope table's eligible list, the migration never took it out of scope. Meta pays cash for a report with a published minimum of $500, sets severity itself, and publishes no payout guideline covering open source, so no maximum is stated in advance. sorona.xyz adds 1.25× on top of whatever Meta awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Meta declares its open-source scope as GitHub organisation prefixes. The scope table's Open source row lists https://github.com/facebook/ and https://github.com/facebookincubator/ as eligible code repos, and CacheLib is covered whichever of the two you resolve it to, since the repository moved from the incubator org to the main one and both are eligible. The row sets no severity cap and Meta publishes no payout guideline covering open source The cache allocator in full: slab classes, the item layout, allocation, eviction and the reference counting that governs item lifetime Navy, the flash-cache engine, covering the block and big-hash engines, region management, the index and the record format read back off a device Serialization of cached items and of on-disk metadata, plus the persistence and warm-roll paths that reload state a previous process wrote The C++ API a service embeds against: key handling, lookup, chained and nested items, and the item-handle contract Memory management across DRAM and flash, the memory pools, and the rebalancing and pool-resizing strategies Compaction, admission policies and the background workers the engine runs on its own schedule The tooling the repository ships, cachebench among it Out of scope Repositories outside those two prefixes. The same scope row names https://github.com/facebookarchive/ as ineligible, and neither facebookresearch/ nor the react/ org that React and React Native moved into appears on the eligible list Extremely low-risk issues, which Meta states may not qualify for a bounty at all Findings with no demonstrated impact on Meta users or systems, since that is what Meta scores a report on Duplicates. Meta pays the first reporter only Awards that sanctions screening blocks: Meta verifies every bounty is permitted under US trade sanctions and economic restrictions Defects in the service that embeds CacheLib rather than in the caching engine itself Cache-hit-rate, eviction-policy and throughput complaints, which are tuning matters rather than vulnerabilities Issues that need the attacker to already hold code execution as the cache process, which sits inside the trust boundary Most-valued findings Memory corruption in the allocator or the item layout reachable from values another service inserted. Memory safety is half the expected distribution here, and the cache process sits very close to the data it holds A deserialization flaw on the flash or warm-roll path, where the engine parses bytes it wrote earlier and an attacker influenced Cross-caller item exposure from a key collision or a stale handle, which hands one caller another caller's cached data Use-after-free driven by eviction racing a live reader, which an attacker steers by shaping the access pattern An input distribution that drives the allocator into pathological fragmentation and takes a cache tier down CacheLib has no CVE record, so this ordering follows the shape of the engine rather than a history of findings. The hand-rolled allocators over hybrid DRAM and flash are the part nobody else has audited Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. File through the report form at bugbounty.meta.com; Meta asks that you not contact its staff directly or through any other channel about a report Awards are entirely at Meta's discretion and Meta determines severity: no published payout guideline covers open source Duplicates pay only the first reporter Meta scores a report on impact to Meta users and systems, so demonstrate the defect from data a caller could actually place in the cache rather than from hand-corrupted internal state Both https://github.com/facebook/ and https://github.com/facebookincubator/ are eligible prefixes, which is why CacheLib's move between the two orgs never interrupted coverage Awards are subject to sanctions screening; Meta verifies that every bounty is permitted under US trade sanctions and economic restrictions Disclosure Coordinated with Meta, on Meta's clock. Its terms ask for reasonable time to investigate and mitigate before you disclose publicly or share the report with others, Meta alone judges what is reasonable, and Meta reserves the right to publish reports and their updates itself. Because that clause reaches private transfer as well as publication, file with Meta directly first. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability