- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 9
- Public CVEs
- 61
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
9 assets you may test, 5 excluded.
Web 1
- https://libexpat.github.io
Products and areas 8
- Character and encoding conversion inside the tokenizer
- Content processing in doContent
- Entity handling and entity-reference expansion, including the general-entity (XML_GE) path and behavior with and without the XML_DTD compile flag
- Namespace processing and attribute and token handling
- Parser creation and reset paths, including XML_ParserCreate, XML_ExternalEntityParserCreate, and XML_ResumeParser
- Prolog and DOCTYPE and DTD processing, covering doProlog, dtdCopy, and the scaffolding index handling around nextScaffoldPart
- Reparse-deferral and big-token accumulation buffers
- The core streaming parser (XML_Parse and XML_ParseBuffer) when fed untrusted XML input
Out of scope (5)
- Application-level misuse of the API that does not stem from a parser defect
- Behavior governed by compile-time flags where the deployment chose the weaker configuration; billion-laughs protection has shipped since 2.4.0 for XML_DTD builds, with builds lacking it and isolated external-entity parsers hardened in 2.6.0 and 2.6.2, so old or misconfigured builds are a packaging concern rather than a new library bug
- Hardening recommendations or scanner output with no demonstrated exploit
- Public disclosure of an unfixed vulnerability on the issue tracker; the policy requires private email first
- Reports missing either an impact description or reproduction steps, both of which are required
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
Include a minimal reproducer with the triggering XML and the API sequence that parses it
-
State the affected version and build configuration, plus observed versus expected behavior
-
Verify against a current release before submitting
-
Report one root cause per submission rather than bundling issues
-
Do not disclose details publicly before a fix is available
-
Spell out what the flaw is and what it lets an attacker do
Not accepted
-
Public disclosure of an unfixed vulnerability on the issue tracker; the policy requires private email first
-
Reports missing either an impact description or reproduction steps, both of which are required
-
Application-level misuse of the API that does not stem from a parser defect
-
Hardening recommendations or scanner output with no demonstrated exploit
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
Sorona credits this project with 61 CVEs, 22 of them recent. The individual records appear here after the next sync.
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 22 Last 12 months 61 Lifetime Memory safety 60 % Denial of service 27 % Info disclosure 7 % Access control 4 % Latest advisories Loading the feed Overview Expat runs a vulnerability disclosure program with no bounty of its own. Report your finding through sorona.xyz and we pay you directly for qualified, reproduced issues, up to 2x the base reward for hard, chained bugs. Expat (libexpat) is a fast, stream-oriented XML parser written in C and embedded across a huge range of software, from Python and Perl to browsers and system libraries, so a single parser flaw propagates widely. A small group of volunteers keeps it going as time allows, which makes clear, reproducible reports especially valuable. In scope The core streaming parser (XML_Parse and XML_ParseBuffer) when fed untrusted XML input Parser creation and reset paths, including XML_ParserCreate, XML_ExternalEntityParserCreate, and XML_ResumeParser Prolog and DOCTYPE and DTD processing, covering doProlog, dtdCopy, and the scaffolding index handling around nextScaffoldPart Content processing in doContent Entity handling and entity-reference expansion, including the general-entity (XML_GE) path and behavior with and without the XML_DTD compile flag Namespace processing and attribute and token handling Character and encoding conversion inside the tokenizer Reparse-deferral and big-token accumulation buffers Out of scope Public disclosure of an unfixed vulnerability on the issue tracker; the policy requires private email first Reports missing either an impact description or reproduction steps, both of which are required Behavior governed by compile-time flags where the deployment chose the weaker configuration; billion-laughs protection has shipped since 2.4.0 for XML_DTD builds, with builds lacking it and isolated external-entity parsers hardened in 2.6.0 and 2.6.2, so old or misconfigured builds are a packaging concern rather than a new library bug Application-level misuse of the API that does not stem from a parser defect Hardening recommendations or scanner output with no demonstrated exploit Most-valued findings Billion-laughs and exponential entity-expansion denial of service (as in CVE-2013-0340, CVE-2023-52426 for non-XML_DTD builds, and CVE-2024-28757 for isolated external-entity parsers) Stack overflow from recursive entity expansion or deep entity chaining (CVE-2024-8176) Quadratic-runtime denial of service from big tokens (CVE-2023-52425) and memory amplification where small input drives disproportionate heap allocation (CVE-2025-59375) Integer overflow leading to memory corruption, for example in dtdCopy (CVE-2024-45491) and nextScaffoldPart (CVE-2024-45492) Out-of-bounds read or write, such as the scaffolding index store in doProlog (CVE-2026-56132) Heap use-after-free, including shared-DTD teardown (CVE-2022-43680) and doContent (CVE-2022-40674), and crashes in the resume path (CVE-2024-50602) Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Include a minimal reproducer with the triggering XML and the API sequence that parses it State the affected version and build configuration, plus observed versus expected behavior Verify against a current release before submitting Report one root cause per submission rather than bundling issues Do not disclose details publicly before a fix is available Spell out what the flaw is and what it lets an attacker do Disclosure Coordinated disclosure through sorona.xyz. Expat asks that reports stay private and that roughly three months' lead time be allowed for a fix to ship, so sorona.xyz keeps details confidential and works the timeline out with the maintainers (note upstream intake resumes 2026-08-01). Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability