GnuTLS

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Separately, for a merged upstream patch : $100 - $5,000 Google Patch Rewards pays this project as a Tier 2 target (it qualifies through its OSS-Fuzz integration), for a patch you land upstream and that stays merged, without reverts, for one month. It is paid for the patch, not for the report, and it is rate-limited to three submissions a month. Sanctions and territory exclusions apply. CVE history 9 Last 12 months 75 Lifetime Memory safety 35 % Denial of service 30 % Info disclosure 20 % Auth bypass 15 % Latest advisories Loading the feed Overview This project runs a vulnerability disclosure program with no bounty of its own. Report through sorona.xyz and we pay you directly on qualified, reproduced findings, with payouts reaching up to 2x the base for hard, chained bugs. GnuTLS is a widely deployed GNU library implementing SSL 3.0, TLS 1.0 through 1.3, DTLS, and X.509 certificate handling, used across countless applications and distributions to secure network communications. The team takes security seriously, tracks issues under GNUTLS-SA advisory identifiers, and rates severity by real-world exploitability rather than raw CVSS. In scope Memory-safety defects in the core libgnutls library reachable from untrusted network peers: heap and stack overflows, use-after-free, and out-of-bounds reads or writes The TLS and DTLS handshake and record layers, covering key exchange, session resumption, and fragment reassembly across TLS 1.0 through 1.3 X.509 certificate parsing and chain building, including path validation, name-constraint enforcement, and CRL/OCSP handling, and any bug that lets an attacker bypass verification ASN.1 and DER decoding paths inside GnuTLS that process attacker-supplied certificates and structures Import parsing of PKCS containers from untrusted data (PKCS#7, PKCS#8, PKCS#12) and other certificate or key material Protocol-level cryptographic handling exposed by the library, including timing and side-channel exposure in supported operations Client-side denial of service or memory corruption triggered by a malicious or compromised server Server-side denial of service or memory-safety failure triggered by malicious peer input Remote unauthenticated conditions that lead to crash, hang, memory disclosure, or code execution Out of scope Attacks that assume the attacker can already alter trusted inputs such as private keys or the trusted CA store, which sit inside the trust boundary Application-side API misuse: invalid enum values, calling functions after deinit, or invoking the API out of the documented order Defects that actually live in bundled dependencies rather than GnuTLS itself, including nettle, libtasn1, gmp, and p11-kit, which belong upstream to those projects Problems confined to the diagnostic command-line utilities such as gnutls-cli, gnutls-serv, and gnutls-cli-debug rather than the library Obsolete or deprecated subsystems: the OpenSSL compatibility layer, SRP, TPM 1.2, DTLS 0.9, and SSL 3.0 Technology-preview features, including PKCS#11 provider mode and HPKE Objections to default algorithm, cipher, or protocol selection, which are policy and configuration matters rather than vulnerabilities Most-valued findings Remote, unauthenticated arbitrary code execution reachable on common platforms (the project's Critical tier) Memory-safety flaws driven by untrusted input in handshake or parsing code: buffer overflow and overread, heap and stack corruption, and use-after-free Certificate or chain validation bypass and other authentication-integrity failures Client-side denial of service, such as a crash or hang forced by a malicious server Server-side denial of service driven by malicious peers Exploitable cryptographic weaknesses, including timing and side-channel leaks, weighted lower unless readily exploitable Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Submit each report self-contained and actionable, ideally with a standalone reproducer that needs no follow-up One vulnerability per report; do not bundle unrelated issues Provide clear reproduction steps, affected versions, and expected versus observed behavior Assume applications follow best practices (compiler hardening, least privilege, correct API use) when framing impact No social engineering, phishing, or targeting of project maintainers or infrastructure Do not run intrusive automated scans or load testing against project services Disclosure GnuTLS practices coordinated disclosure without a fixed embargo window; timing is set case by case based on severity, the roughly two-month release cadence, and team capacity, with fixes backported to 3.6 and later where applicable. Confirmed issues are published as GNUTLS-SA advisories once a fix or mitigation is available. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability