Envoy

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Severity │ sorona.xyz pays on the program's payout, up to +$1,000 │ 1.25× complexity bonus, on top │ up to $1,000 Submit a vulnerability CVE history 30 Last 12 months 110 Lifetime Denial of service 45 % Memory safety 30 % Auth bypass 13 % Parsing/validation 12 % Latest advisories Loading the feed Overview Envoy already runs a paid vulnerability reward program, funded by Google through its Patch Reward Program and administered jointly with the Envoy OSS security team. Route your report through sorona.xyz and we pay 1.25x whatever it awards, plus up to $1,000 more for especially complex or well-chained bugs. Envoy is a CNCF-graduated, high-performance C++ edge and service-mesh data-plane proxy; it maintains a formal Product Security Team, a documented threat model, and an embargoed disclosure-and-release process. In scope Network data-plane attacks only: the finding must arrive over the network against the edge Envoy listener on HTTPS port 10000, using the program's reference static configuration Envoy core components hardened against untrusted peers, those marked robust_to_untrusted_downstream_and_upstream, such as the HTTP router filter, the TLS transport socket, the decompressor, the connection-limit filter, and the DNS resolvers Stable extensions marked robust_to_untrusted_downstream (which assume a trusted upstream), for example compression, access loggers, health checkers, and most HTTP filters, when they are exercised through untrusted downstream traffic Only extensions carrying a stable status and a robust_to_untrusted_* posture in the security-posture manifest are eligible Resilience to malicious or adversarial xDS configuration where, in a multi-tenant deployment, the config itself may come from an untrusted source (config-delivered attacks against hardened components) Version eligibility: for point releases, only the latest point release at submission time; for development builds, only main builds cut within the last five days Out of scope Local attacks: anything delivered via a local process, shell, or path other than the network data plane, plus kernel, Docker, and container vulnerabilities The control plane and xDS management server (treated as trusted), and wire-level attacks against the xDS transport protocol Untrusted services invoked during request processing that Envoy treats as trusted: external authorization, rate limiting, access logging, credential suppliers, and runtime services The admin console and admin interface Extensions without stable status, everything under the contrib/ directory, and any extension of unknown posture Extensions marked requires_trusted_downstream_and_upstream (Redis, Mongo, Thrift, PostgreSQL proxies, WASM, Lua, dynamic modules) and data_plane_agnostic components (resource monitors, stat sinks) Generic DoS or brute force below the 100x amplification threshold (aside from the specified OOM-with-stream-limit case), release-build ASSERT failures, deprecated or flag-disabled features, mere lack of a safe default, and anything already public Most-valued findings Query-of-death: a single small request that segfaults or aborts the Envoy process Data confidentiality or integrity loss caused by untrusted downstream-client or untrusted upstream-server traffic on the data plane Out-of-memory or resource exhaustion achievable with 100 or fewer total connections/streams, or availability bugs with 100x-plus asymmetric resource-consumption amplification against a hardened component Routing-rule bypass that reaches a route or backend meant to be inaccessible ('hidden treasure') TLS private-key or certificate exfiltration (for example leaking serverkey.pem) Remote code execution reachable via the network data plane Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Report through sorona.xyz; upstream, valid findings go to the Envoy Product Security Team via GitHub Security Advisory or [email protected] Reproduce the bug against a current release or recent main build using Envoy's Docker-based test environment on the data-plane port Demonstrate a concrete qualifying impact (crash, OOM, routing/access bypass, cert exfiltration, or RCE) rather than a theoretical concern Do not submit the same issue in parallel to Google's or Lyft's reward programs Honor the embargo: keep details, source, and any binaries private until the coordinated public release Google PRP payouts are claimed after the fix is publicly released, by supplying proof such as the merged patch and resolved advisory Disclosure Coordinated disclosure under embargo, run by the Envoy Product Security Team, which requests CVEs, cuts security-only patch releases, and notifies the private distributor list. Private reports receive a fix or public disclosure within 90 days, with distributors typically given a three-week window from patch availability to the embargo deadline. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability