fizz

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Minimum award, where Meta pays a bounty at all │ $500 │ $625 Maximum: discretionary, no published ceiling for open source │ not published │ not published Submit a vulnerability CVE history 0 Last 12 months 3 Lifetime Denial of service 40 % Memory safety 25 % Parsing/validation 20 % Auth bypass 10 % Latest advisories Loading the feed Overview fizz is Meta's TLS 1.3 implementation and the cryptographic layer underneath Proxygen, wangle and mvfst, so it terminates TLS for Meta at scale. What it is matters more than how many people install it directly: this is a cryptographic protocol implementation that processes attacker-controlled bytes before authentication completes, which is the highest-value reachability class there is: anyone who can open a socket can reach the parser. Its three CVEs (CVE-2019-3560, CVE-2019-11924 and CVE-2023-23759) skew toward unauthenticated denial of service, which is what forty percent of the expected distribution here reflects. One practical trap: the repository is facebookincubator/fizz , and facebook/fizz is a hard 404 rather than a redirect, so a scope check against the wrong org concludes the project does not exist. Meta pays cash for a report with a published minimum of $500, determines severity itself, and publishes no payout guideline covering open source, so no maximum is stated in advance. sorona.xyz adds 1.25× on top of whatever Meta awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Meta declares its open-source scope as GitHub organisation prefixes. The scope table's Open source row lists https://github.com/facebook/ and https://github.com/facebookincubator/ as eligible code repos, and fizz is eligible under the second, facebookincubator/fizz . The row sets no severity cap and Meta publishes no payout guideline covering open source The TLS 1.3 state machine on both sides, client and server, from the first flight through to post-handshake messages Handshake message parsing and construction: ClientHello, extensions, key shares, certificate messages and everything else a peer sends before authentication completes The record layer: framing, length handling, padding, encryption and decryption The key schedule and key derivation, session tickets, PSK binders, early data and its replay handling Certificate handling and chain verification, along with the certificate selection and verification interfaces an embedder plugs into The cryptographic layer the library ships: its OpenSSL bindings, exporters, AEADs and hash implementations The API fizz presents upward to Proxygen, wangle and mvfst, where a handshake outcome is reported to a transport that then trusts it Out of scope Repositories outside those two prefixes. The same scope row names https://github.com/facebookarchive/ as ineligible, and neither facebookresearch/ nor the react/ org that React and React Native moved into appears on the eligible list Extremely low-risk issues, which Meta states may not qualify for a bounty at all Findings with no demonstrated impact on Meta users or systems, since that is what Meta scores a report on Duplicates. Meta pays the first reporter only Awards that sanctions screening blocks: Meta verifies every bounty is permitted under US trade sanctions and economic restrictions Defects in the transports that consume fizz, Proxygen, wangle and mvfst, each of which is its own repository with its own entry under the same program OpenSSL itself, which fizz links against and which belongs to another project Objections to fizz's default cipher-suite, group or protocol-version selection, which are configuration choices rather than implementation defects Most-valued findings Pre-authentication memory corruption in handshake or record parsing, reachable by anyone who can open a socket and the shortest path to the code-execution rung Meta prices at the top of its discretionary band Authentication bypass: a forged or unverified peer identity accepted as valid, which breaks the single guarantee every layer above fizz depends on Unauthenticated denial of service triggered during the handshake. That is 40% of the expected distribution and the class CVE-2019-3560 sat in Key-schedule, PSK-binder or early-data flaws that permit replay, downgrade or key recovery Any of the above demonstrated through Proxygen or mvfst, since that is what shows Meta the impact on traffic it actually terminates The three CVEs on record (CVE-2019-3560, CVE-2019-11924, CVE-2023-23759) all skew to remote denial of service. A memory-safety or authentication finding is the one that lifts a report off the floor band Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. File through the report form at bugbounty.meta.com; Meta asks that you not contact its staff directly or through any other channel about a report Awards are entirely at Meta's discretion and Meta determines severity: no published payout guideline covers open source Duplicates pay only the first reporter Meta scores a report on impact to Meta users and systems, so a handshake defect demonstrated through Proxygen or mvfst carries more weight than the same defect shown only against a test server fizz is eligible under https://github.com/facebookincubator/ , the second prefix on the scope table's Open source row; facebook/fizz does not exist and returns a hard 404 Awards are subject to sanctions screening; Meta verifies that every bounty is permitted under US trade sanctions and economic restrictions Disclosure Coordinated with Meta, on Meta's clock. Its terms ask for reasonable time to investigate and mitigate before you disclose publicly or share the report with others, Meta alone judges what is reasonable, and Meta reserves the right to publish reports and their updates itself. Because that clause reaches private transfer as well as publication, file with Meta directly first, and hold detail on a cryptographic finding until the fix has shipped. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability