FRRouting

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Separately, for a merged upstream patch : up to $5,000 Google Patch Rewards pays on the Tier 2 OSS-Fuzz row for a patch you get accepted upstream and that stays merged, without reverts, for one month, not for the report. Memory-safety work can carry a 2× or 3× multiplier. One-liner fixes for non-exploitable crashes, including resource-exhaustion crashes, are excluded, which on FRR means a systemic parser-hardening patch is the shape that pays. Sanctions and territory exclusions apply. CVE history 14 Last 12 months 48 Lifetime Denial of service 45 % Memory safety 30 % Parsing/validation 20 % Latest advisories Loading the feed Overview FRRouting is the control plane of the open-networking movement: the routing stack inside SONiC, the switch NOS used across Microsoft Azure and a large slice of hyperscale and enterprise data-centre fabrics, plus NVIDIA Cumulus Linux, DENT, OpenWrt, VyOS, bare-metal providers, a long list of white-box switch vendors, and Kubernetes networking through MetalLB and Calico's BGP mode. FRR runs on the spine and leaf switches carrying traffic inside data centres and speaks BGP to the public internet at the edge. A bgpd parsing bug is reachable from any BGP speaker that can reach the session, and on eBGP that includes peers the operator does not control. The project pays nothing for a vulnerability report, so sorona.xyz pays you directly on a qualified, reproduced finding. In scope The project takes security reports at [email protected] and runs a documented embargo process over them. What is covered is upstream FRR itself, with nothing narrower carved out of the daemon set bgpd in full: UPDATE, OPEN and capability parsing, path-attribute handling, policy and route-map evaluation, and the BGP-LS, EVPN and flowspec extensions ospfd and ospf6d end to end, LSA parsing included, reachable from any adjacent device on a shared segment The rest of the routing daemons the project ships rather than only the ones carrying a CVE: isisd , babeld , ripd , ripngd , eigrpd , pimd , ldpd , nhrpd , bfdd , pbrd , staticd and vrrpd The zebra RIB and FIB daemon and its netlink boundary, where a routing-table corruption becomes a traffic redirect The management and operator surface as a whole: the VTY shell, vtysh , the mgmtd northbound YANG configuration path, and the gRPC and SNMP interfaces The shared library layer every daemon links, covering the packet stream buffers, the prefix and nexthop code and the memory allocators underneath them Out of scope BIRD, OpenBGPD and vendor routing stacks, none of which is OSS-Fuzz integrated or covered here Route hijacking that is a policy failure rather than a code defect: no RPKI, permissive filters, and similar operator choices Patches that SONiC, Cumulus or another distribution carries on top of FRR rather than upstream code Anything that requires an already-established session with a trusted BGP peer, where the peer is the trust boundary One-line fixes for non-exploitable crashes, which the Patch Rewards rules exclude, including crashes that come from resource exhaustion Most-valued findings A remotely triggerable bgpd crash or hang from a malformed UPDATE or path attribute, reachable from an eBGP peer the operator does not control. bgpd is the densest attack surface in the project and the source of most of its CVEs, 45% of that history is denial of service, and on a data-centre spine an outage is not an inconvenience Memory corruption in the bgpd attribute or capability parser, which is the same reachability with code execution on the control plane behind it LSA parsing flaws in ospfd or ospf6d that let one compromised device on a shared segment poison the routing state of the whole area Route or FIB corruption through zebra and its netlink boundary, where the outcome is silently redirected traffic rather than a visible failure A systemic hardening patch across a protocol parser that removes a whole crash class at once. The rules explicitly refuse one-liner non-exploitable crash fixes, so on FRR that is the work the ceiling is written for Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Send a detailed, reproducible report to the FRR security list, which runs the project's documented embargo process; if it cannot be reproduced it is not eligible Give the maintainers room to batch the fix into an advisory before any public writeup. FRR ships several multi-CVE advisories a year and yours will likely travel in one A finding that needs an already-established session with a trusted BGP peer is out: the peer is the trust boundary there The Google patch money is a separate pathway: you land the fix upstream yourself and keep it merged, without reverts, for one month The rules exclude one-liner fixes for non-exploitable crashes, including resource-exhaustion crashes, so on a DoS-heavy project like this one it is systemic parser hardening that pays Google cannot pay anyone on a sanctions list, in a sanctioned territory, or located in Russia or Belarus Disclosure Coordinated with the FRRouting maintainers through [email protected] under a documented Linux Foundation embargo process. Fixes are usually batched into a release-time advisory with researcher credit, so hold the detail until that advisory is published. Nothing in the Patch Rewards rules restricts who may help you prepare or route the report. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability