golang.org/x libraries

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Product vulnerability (Tier OT0; supply-chain compromise is a separate category) │ $500 - $7,500 │ $625 - $8,500 Other security issue (Tier OT0 flat award) │ $1,000 │ $1,250 Submit a vulnerability CVE history 37 Last 12 months 76 Lifetime Denial of service 40 % Parsing/validation 25 % Auth bypass 20 % Info disclosure 10 % Latest advisories Loading the feed Overview These seven modules are the de facto extended standard library of Go, and Go is the implementation language of the cloud-native control plane. x/net/http2 sits in the request path of Kubernetes, etcd, Docker, containerd, Traefik, Caddy, Prometheus and most Go HTTP servers running in production; the HTTP/2 Rapid Reset class of bug in this exact code triggered an industry-wide patch cycle. x/crypto/ssh is the SSH implementation behind Gitea, Teleport and a great deal of infrastructure tooling, and x/image decoders are reachable from user-uploaded files in Go web services. With 76 CVEs across their history and 37 in the last twelve months, this is both the highest-volume and the highest-reachability code Google covers on this program, and Google rates all seven at the top band. Tier OT0 pays $500 to $7,500 for a product vulnerability, with a discretionary panel deciding where in that band a finding lands. sorona.xyz adds 1.25× on top of whatever Google awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Google's tier file names seven golang.org/x repositories at OT0: golang/net , golang/crypto , golang/text , golang/image , golang/sync , golang/tools and golang/sys . Everything those seven modules publish is in, and a product vulnerability is priced at $500 to $7,500 x/net/http2 : the HTTP/2 server and client, HPACK header decoding, and stream and flow-control handling that an unauthenticated peer drives directly The rest of x/net : the html tokenizer and parser operating on untrusted markup, plus websocket , proxy , idna , publicsuffix , http/httpguts and dns/dnsmessage x/crypto/ssh : the server, client, agent and known-hosts handling that most Go SSH tooling is built on, including authentication and the handshake The rest of x/crypto : acme and autocert , openpgp , ocsp , and the primitives argon2 , bcrypt , scrypt , nacl , chacha20poly1305 and hkdf x/image : the TIFF, WebP, BMP, VP8 and CCITT decoders, which operate on untrusted bytes and are commonly reached from user uploads, plus the font and vector drawing packages x/text : encoding conversion, Unicode normalisation, secure/bidirule , collation, message formatting and language matching, where a normalisation difference can become a filter bypass x/sync : errgroup , semaphore and singleflight , the concurrency primitives a great deal of Go infrastructure schedules work through x/sys : the raw syscall surface and the unix and windows bindings, including CPU feature detection x/tools : gopls , go/analysis , go/packages and the rest of the tooling libraries, where the interesting path is analysing source someone else wrote Module publishing, and the repository and pipeline integrity Google prices in the supply-chain category Out of scope The Go standard library and compiler, which live in golang/go and are covered separately Third-party Go modules that merely import these packages rather than defects in the packages themselves x/tools issues confined to a developer's own machine with no realistic remote attack path Deprecated x/crypto packages whose documentation already directs users to the standard library Downstream servers that switch off the mitigations these modules provide, which is an operator configuration choice Repositories the tier file does not name, and releases that are not current: the program covers the latest versions of the listed repositories, and any other repository in the same organisation counts only where the file names it. What the file omits sits at OT2 or OT3, where product vulnerabilities earn no monetary reward Reports filed by anyone other than the researcher: Google requires the submission under your own identity through bughunters.google.com, and treats routing around the designated channel as grounds to reject Awards to researchers on sanctions lists, in territories subject to sanctions, or located in Russia or Belarus, which Google states it will not issue Most-valued findings Authentication or handshake bypass in x/crypto/ssh that lets an unauthenticated client reach a session, the highest-value finding here because it hands over the machine rather than degrading it HTTP/2 request smuggling or desynchronisation in x/net/http2 that lets one client's request be attributed to another across a proxy boundary Remotely triggerable resource exhaustion in HTTP/2 stream or flow-control handling in the Rapid Reset shape, the class that dominates this code at 40% of findings and the one with the widest simultaneous blast radius Memory-unsafe or panicking decoder paths in x/image reached from an uploaded file, since those decoders sit behind user upload endpoints in a great many Go services Normalisation or encoding differences in x/text that let a crafted string pass an application's filter and mean something else downstream Certificate-issuance or account-key handling flaws in acme/autocert , which quietly holds the TLS identity of the service that uses it Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. The Go standard library and compiler live in golang/go , a separate entry: report those there rather than here Only the seven golang.org/x modules listed in Google's tier file are covered: net, crypto, text, image, sync, tools and sys x/tools findings that only affect a developer's own machine, with no realistic remote attack path, are not treated as security issues Frame the report accurately: a bug in the module's own code is a product vulnerability, while compromise of the repository or release pipeline is a separate and differently priced supply-chain category Google's reward panel sets the amount at its discretion within the published band, so the tier ceiling is a maximum rather than an expectation Google's rules state that privately disclosing a flaw to a third party, for any purpose other than fixing it, will typically not qualify for a reward Disclosure Coordinated through Google Bug Hunters and the Go security team, which lands the fix, tags a module release and publishes a Go vulnerability database entry with researcher credit. Because Google treats a private disclosure to a third party as grounds for disqualification, file with Google directly and hold the detail until the advisory is out: findings in this code routinely trigger coordinated multi-vendor patch cycles. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability