Firecracker

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 2 Last 12 months Guest-to-host memory safety 45 % Sandbox/jailer escape 30 % Path traversal 15 % Info disclosure 10 % Latest advisories Loading the feed Overview Firecracker is a minimal Rust VMM built on KVM, and it is the isolation boundary under AWS Lambda and Fargate. Fly.io, Vercel Sandbox and several other sandbox providers run on it as well, so a single virtio defect is a cross-tenant compromise of the largest serverless fleet in the world. CVE-2026-5747 is the reference point: an out-of-bounds write in the virtio-pci transport, reachable from guest code, reported for nothing. Firecracker appears on HackerOne only inside the AWS Vulnerability Disclosure Program, which pays no bounties and flags the Firecracker asset itself as ineligible. sorona.xyz pays you directly on qualified, reproduced findings. In scope The published channel accepts vulnerability reports in Firecracker through the AWS disclosure programme or the security address. Neither document draws a boundary narrower than the VMM and its tooling, so everything below is inside it The virtio device model in full: block, net, balloon, vsock and rng, along with the virtio-pci and MMIO transports that carry them The jailer end to end, covering its chroot construction, user and namespace handling, and every file it touches while still privileged The API server and its socket, covering every configuration action a control plane can request before and after boot Guest memory management, including KVM memory slots, ballooning and the memory backing behind a running microVM Snapshot create and restore in full, including the format the restore path parses and the state it accepts The seccomp filter set that confines the Firecracker process itself The block device backends, drive file handling and the rate limiters applied to them The metadata service (MMDS), the metrics sink and the logging path, wherever host-side data becomes guest-readable The guest-facing vsock device and any other channel bridging guest data to a host process Out of scope Amazon retail properties, consumer devices and mobile apps, which belong to the paying Amazon programmes and share nothing with this repository The host Linux kernel and KVM itself, unless Firecracker's use of an interface is what makes the defect reachable rust-vmm crates consumed as dependencies, unless Firecracker's integration is what creates the bug AWS Lambda and Fargate as operated services rather than the open-source VMM, which route through AWS's own service channels Denial of service against a host whose operator configured no resource limits, a deployment decision rather than a VMM defect Mistakes in an integrator's own jailer invocation rather than defects in the jailer itself Most-valued findings Anything a guest reaches out of, ahead of everything else. CVE-2026-5747 put an out-of-bounds write in the virtio-pci transport, the shortest path there is from guest code to host memory Jailer defects that let a confined process touch host state. CVE-2026-1386 overwrote arbitrary host files through a symlink before the sandbox had closed Descriptor and buffer handling in the block and net backends, where guest-controlled rings drive host-side pointers and lengths Snapshot restore parsing, since restored state is attacker-controlled input in any workflow that accepts a snapshot from elsewhere API socket authorisation, particularly actions reachable while the microVM is only partly configured Seccomp filter gaps that widen the syscall surface available to a compromised Firecracker process MMDS or vsock paths that surface host or neighbouring-tenant data inside a guest Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report through the AWS Vulnerability Disclosure Program on HackerOne or by email to [email protected] ; the repository's SECURITY.md routes to both The HackerOne listing is intake rather than money. The AWS VDP returns no bounty table and marks the Firecracker asset ineligible for bounty, and the policy text contains no reward language at all AWS's paying programmes cover Amazon retail properties, consumer hardware and mobile apps. No AWS open-source repository is in scope for either of them, so do not expect a cross-referral Give the exact Firecracker version, the full microVM configuration JSON and whether the jailer was in use. The two 2026 advisories split along exactly that line For guest-side reproduction, state the guest kernel and the device path taken. The virtio transports are where severity concentrates on this codebase Outcomes are published as AWS Security Bulletins and as advisories on the repository, so agree the publication date in writing rather than assuming a fixed window Disclosure Coordinated by the AWS security team through the disclosure programme or the security address, with the result published as an AWS Security Bulletin and, for the VMM itself, a GitHub Security Advisory on firecracker-microvm/firecracker. The policy describes investigation and coordination without committing to a timeline, so treat the embargo as negotiated rather than standard. Both 2026 advisories carried CVE identifiers, so expect CVE allocation on anything that reaches the guest-to-host boundary. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability