- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 11
- Public CVEs
- 19
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
11 assets you may test, 5 excluded.
Web 1
- https://github.com/osrg/gobgp
Products and areas 10
- BMP monitoring output and MRT file parsing on both the write and read sides
- RPKI-RTR client handling and the way validation state feeds route selection
- Session state handling, including capability negotiation, graceful restart, add-path and route refresh
- The address families layered on top: IPv4 and IPv6 unicast, VPN and EVPN, flowspec, SR-Policy and the rest of the AFI/SAFI set the library advertises
- The BGP message decoder in full: OPEN, UPDATE, NOTIFICATION, KEEPALIVE and ROUTE-REFRESH, plus every path attribute and NLRI encoding the library will parse
- The gRPC API and the gobgp CLI that drives it, including the API's authentication and access model as exposed by an embedding application
- The library API as consumed by embedders, since a large part of this project's deployment is inside another product
- The policy accepts security vulnerabilities in GoBGP through GitHub private vulnerability reporting and declares no narrower boundary. It constrains where a report goes rather than what qualifies
- The policy engine: prefix sets, neighbour sets, AS-path handling, and the statements that permit, reject or modify a route
- The zebra integration used to program routes through an external routing stack
Out of scope (5)
- Defects in an embedding application rather than in GoBGP's own code
- Operator policy configuration that accepts a prefix it should have filtered
- Public issue reports and third-party CNA submissions, both ruled out by the policy
- Route hijacking by a peer sending what it is configured and authorised to send, which is BGP behaving as specified
- The Go runtime and standard library, unless GoBGP's use of them is what makes the issue reachable
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
Report through GitHub private vulnerability reporting on osrg/gobgp, the channel the policy names. It is enabled on the repository
-
Do not open a public issue; the policy rules that out explicitly
-
Do not take the finding to a third-party CVE numbering authority. The maintainers assign CVEs themselves as GitHub Security Advisories and ask reporters to leave that step to them
-
Give the exact message bytes. Nearly every finding here is a decode defect, so a PCAP or a hex dump of the offending UPDATE is worth more than several paragraphs of prose
-
State whether you hit the daemon or the library. GoBGP is consumed both ways, and a panic inside an embedded controller has a different blast radius from one that kills gobgpd
-
Say whether an established session is required, since a defect reachable before the OPEN exchange completes is available to a much larger set of attackers
Not accepted
-
Route hijacking by a peer sending what it is configured and authorised to send, which is BGP behaving as specified
-
Operator policy configuration that accepts a prefix it should have filtered
-
Defects in an embedding application rather than in GoBGP's own code
-
The Go runtime and standard library, unless GoBGP's use of them is what makes the issue reachable
-
Public issue reports and third-party CNA submissions, both ruled out by the policy
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
Sorona credits this project with 19 CVEs, 13 of them recent. The individual records appear here after the next sync.
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 13 Last 12 months 19 Lifetime BGP message parsing 45 % Denial of service 25 % Out-of-bounds read 20 % Integer over/underflow 10 % Latest advisories Loading the feed Overview GoBGP is a BGP implementation written in Go, run as a standalone daemon and also embedded as a library inside SDN controllers and cloud routing stacks that needed to speak BGP from Go. Its input is BGP messages from peers, and thirteen CVEs landed in the last twelve months against nineteen in its whole history. CVE-2026-37462 is the shape: an integer underflow in BGPUpdate.DecodeFromBytes, reachable by anything that can complete a session. The maintainers run their own advisories through GitHub and pay nothing for a report. sorona.xyz pays you directly on qualified, reproduced findings. In scope The policy accepts security vulnerabilities in GoBGP through GitHub private vulnerability reporting and declares no narrower boundary. It constrains where a report goes rather than what qualifies The BGP message decoder in full: OPEN, UPDATE, NOTIFICATION, KEEPALIVE and ROUTE-REFRESH, plus every path attribute and NLRI encoding the library will parse The address families layered on top: IPv4 and IPv6 unicast, VPN and EVPN, flowspec, SR-Policy and the rest of the AFI/SAFI set the library advertises Session state handling, including capability negotiation, graceful restart, add-path and route refresh The policy engine: prefix sets, neighbour sets, AS-path handling, and the statements that permit, reject or modify a route The gRPC API and the gobgp CLI that drives it, including the API's authentication and access model as exposed by an embedding application BMP monitoring output and MRT file parsing on both the write and read sides RPKI-RTR client handling and the way validation state feeds route selection The zebra integration used to program routes through an external routing stack The library API as consumed by embedders, since a large part of this project's deployment is inside another product Out of scope Route hijacking by a peer sending what it is configured and authorised to send, which is BGP behaving as specified Operator policy configuration that accepts a prefix it should have filtered Defects in an embedding application rather than in GoBGP's own code The Go runtime and standard library, unless GoBGP's use of them is what makes the issue reachable Public issue reports and third-party CNA submissions, both ruled out by the policy Most-valued findings Memory-unsafe behaviour in message decoding. In Go the payoff is usually a panic that takes the process down, and CVE-2026-37461 (out-of-bounds read in ParseIP6Extended) and CVE-2026-37462 (integer underflow in BGPUpdate.DecodeFromBytes) are both that shape at 7.5 Anything reachable before a session is fully established, where the attacker set becomes everyone who can reach the listening port rather than a configured peer Decode defects in the less-travelled address families. EVPN, VPN and flowspec encodings carry far more structure than plain IPv4 unicast, and correspondingly more parsing Panics in an embedded deployment, where GoBGP going down takes an SDN controller or a cloud routing service with it. Five vendor advisories plus the wider NVD set in twelve months say this surface is still producing Route or policy handling that installs or advertises something the policy engine should have rejected, which is a control-plane compromise rather than an outage gRPC API defects where an unauthenticated or under-authorised caller can reconfigure peers or inject routes Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report through GitHub private vulnerability reporting on osrg/gobgp, the channel the policy names. It is enabled on the repository Do not open a public issue; the policy rules that out explicitly Do not take the finding to a third-party CVE numbering authority. The maintainers assign CVEs themselves as GitHub Security Advisories and ask reporters to leave that step to them Give the exact message bytes. Nearly every finding here is a decode defect, so a PCAP or a hex dump of the offending UPDATE is worth more than several paragraphs of prose State whether you hit the daemon or the library. GoBGP is consumed both ways, and a panic inside an embedded controller has a different blast radius from one that kills gobgpd Say whether an established session is required, since a defect reachable before the OPEN exchange completes is available to a much larger set of attackers Disclosure Coordinated through GitHub private vulnerability reporting with the maintainers, who draft the advisory and assign the CVE themselves as a self-managed GitHub Security Advisory. Publication lands with the fix in the repository, and the 2026 record shows advisories going out in small clusters rather than on a fixed clock. Hold detail until the advisory is public, and give the embedders time, since much of the install base ships GoBGP inside someone else's binary. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability