- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 10
- Public CVEs
- 166
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
10 assets you may test, 7 excluded.
Web 1
- https://sourceware.org/glibc
Products and areas 9
- alloca and variable-length arrays where an untrusted-influenced size can drive unbounded stack growth, plus deep-recursion paths that can exhaust the stack
- Character-set and iconv conversion and the gconv modules when parsing untrusted byte sequences
- nscd, the name service cache daemon, where crashes are generally security bugs unless only reachable from a trusted data source (DNS untrusted; NIS and LDAP treated as trusted)
- setuid and privilege-sensitive code paths and environment handling inside privileged programs
- The dynamic loader (ld.so / ld-linux): module loading, symbol resolution, and handling of environment variables that influence loading in setuid or otherwise privileged contexts
- The malloc/free allocator when corruption is reachable from untrusted-influenced data, and string and buffer routines where untrusted data reaches the buffer
- The name-resolution and NSS stack: the resolver (libresolv, getaddrinfo, gethostbyname), DNS response parsing where DNS is treated as untrusted input, and NSS module dispatch
- The printf and scanf family and format-string processing when the data could plausibly come from an untrusted source
- The regular-expression engine (regcomp, regexec), subject to the crafted-pattern carve-outs below
Out of scope (7)
- Asynchronous I/O and thread-cancellation crashes or resource leaks unless a real application, not a synthetic test case, has genuine security exposure
- Bugs that merely destabilize the whole system without any practical exploitation path, which are not classed as security issues
- Failure of a post-exploitation hardening mitigation to block a separate bug, which is not itself a vulnerability
- ldd run against untrusted or crafted executables, which is outside its intended use
- nscd crashes reachable only from a trusted data source such as NIS or LDAP rather than DNS
- Regex crafted-pattern behavior treated as ordinary bugs rather than security: memory exhaustion, quadratic or exponential (catastrophic backtracking) runtime, and stack overflow from recursion while processing a crafted pattern (crashes, infinite loops, buffer overflows and overreads, memory leaks, and other undefined behavior in regex remain in scope)
- wordexp denial of service from crafted patterns, which is not treated as a security issue
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
Provide a clear reproduction: affected version, code path, and how untrusted data reaches the flaw
-
Report network-exposed, privilege-escalation, or critical embargo-worthy issues privately; minor issues may go to public Bugzilla
-
Include rationale for your disclosure choice and let the security team decide on an embargo
-
Do not test against production systems or third-party services running glibc
-
One distinct root cause per report; do not split or duplicate the same underlying bug
-
An embargo is not required to be credited for a discovery
Not accepted
-
Bugs that merely destabilize the whole system without any practical exploitation path
-
wordexp denial of service from crafted patterns
-
Asynchronous I/O and thread-cancellation crashes or resource leaks unless a real application, not a synthetic test case, has genuine security exposure
-
ldd run against untrusted or crafted executables
-
Failure of a post-exploitation hardening mitigation to block a separate bug
-
nscd crashes reachable only from a trusted data source such as NIS or LDAP rather than DNS
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 9 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
Sorona credits this project with 166 CVEs, 11 of them recent. The individual records appear here after the next sync.
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 11 Last 12 months 166 Lifetime Memory safety 64 % Denial of service 16 % Access control 9 % Parsing/validation 6 % Latest advisories Loading the feed Overview glibc runs a vulnerability disclosure program with no bounty of its own. Report qualifying findings through sorona.xyz and we pay you directly on reproduced, in-scope reports, with rewards up to 2x the base rate for genuinely hard, chained, or high-severity bugs. glibc (the GNU C Library) is the core C library underpinning nearly every Linux system, so its security team triages reports carefully and distinguishes true security bugs (exploitable memory corruption, privilege escalation, information disclosure) from ordinary functional defects. In scope The dynamic loader (ld.so / ld-linux): module loading, symbol resolution, and handling of environment variables that influence loading in setuid or otherwise privileged contexts The name-resolution and NSS stack: the resolver (libresolv, getaddrinfo, gethostbyname), DNS response parsing where DNS is treated as untrusted input, and NSS module dispatch nscd, the name service cache daemon, where crashes are generally security bugs unless only reachable from a trusted data source (DNS untrusted; NIS and LDAP treated as trusted) The printf and scanf family and format-string processing when the data could plausibly come from an untrusted source alloca and variable-length arrays where an untrusted-influenced size can drive unbounded stack growth, plus deep-recursion paths that can exhaust the stack The malloc/free allocator when corruption is reachable from untrusted-influenced data, and string and buffer routines where untrusted data reaches the buffer Character-set and iconv conversion and the gconv modules when parsing untrusted byte sequences The regular-expression engine (regcomp, regexec), subject to the crafted-pattern carve-outs below setuid and privilege-sensitive code paths and environment handling inside privileged programs Out of scope Bugs that merely destabilize the whole system without any practical exploitation path, which are not classed as security issues Regex crafted-pattern behavior treated as ordinary bugs rather than security: memory exhaustion, quadratic or exponential (catastrophic backtracking) runtime, and stack overflow from recursion while processing a crafted pattern (crashes, infinite loops, buffer overflows and overreads, memory leaks, and other undefined behavior in regex remain in scope) wordexp denial of service from crafted patterns, which is not treated as a security issue Asynchronous I/O and thread-cancellation crashes or resource leaks unless a real application, not a synthetic test case, has genuine security exposure ldd run against untrusted or crafted executables, which is outside its intended use Failure of a post-exploitation hardening mitigation to block a separate bug, which is not itself a vulnerability nscd crashes reachable only from a trusted data source such as NIS or LDAP rather than DNS Most-valued findings Buffer overflows, treated as security bugs whenever the triggering data could conceivably come from an untrusted source Exploitable or likely-exploitable heap and stack memory corruption Stack exhaustion via unbounded alloca or VLAs whose size could originate from untrusted input Information disclosure, especially where the leak can be demonstrated through real applications Local privilege escalation or server-side denial of service reachable through real, standard-conforming applications Memory leaks or race conditions, counted only where they cause actual service breakage or escalation Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Provide a clear reproduction: affected version, code path, and how untrusted data reaches the flaw Report network-exposed, privilege-escalation, or critical embargo-worthy issues privately; minor issues may go to public Bugzilla Include rationale for your disclosure choice and let the security team decide on an embargo Do not test against production systems or third-party services running glibc One distinct root cause per report; do not split or duplicate the same underlying bug An embargo is not required to be credited for a discovery Disclosure Most glibc security bugs are handled openly in public Bugzilla, while network-exposed, privilege-escalation, and critical issues warrant private coordination and possible embargo before disclosure. Coordinate timing with the glibc security team; advisories are published via libc-announce and archived in the repository from v2.39 onward. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability