GraalVM CE
By GraalVM Community Edition Bug bounty on Sorona graalvm.org
- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 12
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
12 assets you may test, 6 excluded.
Web 1
- https://www.graalvm.org
Products and areas 11
- Espresso, the Java-on-Truffle implementation, and the language runtimes shipped with the distribution
- JNI, the C API and the foreign-function paths where native code and managed code meet
- Native Image and the AOT compilation pipeline, including reachability analysis, reflection configuration and the substitution mechanism
- Oracle's vulnerability reporting process takes reports on any Oracle product by email to its security alerts address, and oracle/graal's SECURITY.md routes GraalVM there without declaring a narrower scope. One stated limit shapes everything below: the project says it does not currently support the execution of untrusted or adversarial code, so frame impact against a trusted-code threat model
- The build tooling: native-image itself, the tracing agent that records reflection configuration, and the Maven and Gradle plugins that drive them
- The Graal JIT compiler and every optimisation in it, where a miscompilation can drop a bounds check or a type check the source required
- The gu component installer and anything else in the distribution that fetches and installs code
- The native-image runtime and the image heap, which is populated at build time and mapped into every process the binary starts
- The polyglot API and the context, resource-limit and sandbox options an embedder configures
- The Substrate VM: its garbage collector, its threading and its isolate boundary
- The Truffle language framework and its interoperability layer, where values cross between guest languages
Out of scope (6)
- Anything Oracle has already addressed in a prior Critical Patch Update
- Execution of untrusted or adversarial code as a threat model, which Oracle states it does not currently support
- GraalVM Enterprise and Oracle's commercial JDK builds where the defect does not reproduce on the Community Edition
- LLVM defects, as distinct from GraalVM's use of LLVM
- OpenJDK defects that reproduce on a stock JDK, which belong to the JDK's own process even though GraalVM inherits them
- Spring Boot, Quarkus, Micronaut and Helidon themselves, each a separate project with its own process
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Submit through sorona.xyz.
-
Email the address on the policy page , the address oracle/graal 's SECURITY.md points to, and encrypt with the published Oracle PGP key
-
Read Oracle's position on untrusted code before you spend a week on a sandbox escape.
-
Reproduce on the Community Edition specifically.
-
Say whether the finding is in GraalVM itself or in the JDK underneath it.
Not accepted
-
Execution of untrusted or adversarial code as a threat model
-
OpenJDK defects that reproduce on a stock JDK
-
LLVM defects, as distinct from GraalVM's use of LLVM
-
Anything Oracle has already addressed in a prior Critical Patch Update
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Latest advisories Loading the feed Overview GraalVM Community Edition is a JVM with an aggressive JIT, a native-image AOT compiler and the Truffle framework that hosts other languages. Native image is what Spring Boot native, Quarkus, Micronaut and Helidon compile with, so a defect in it gets baked into a binary that ships to production. Truffle carries TruffleRuby, GraalPy, GraalJS and Espresso on top. Oracle publishes fixes on a quarterly Critical Patch Update and credits the reporter in the advisory. That credit is the whole reward: Oracle runs no bug bounty and offers no payment at any severity. sorona.xyz pays you directly on qualified, reproduced findings. In scope Oracle's vulnerability reporting process takes reports on any Oracle product by email to its security alerts address, and oracle/graal 's SECURITY.md routes GraalVM there without declaring a narrower scope. One stated limit shapes everything below: the project says it does not currently support the execution of untrusted or adversarial code, so frame impact against a trusted-code threat model The Graal JIT compiler and every optimisation in it, where a miscompilation can drop a bounds check or a type check the source required Native Image and the AOT compilation pipeline, including reachability analysis, reflection configuration and the substitution mechanism The native-image runtime and the image heap, which is populated at build time and mapped into every process the binary starts The Truffle language framework and its interoperability layer, where values cross between guest languages The polyglot API and the context, resource-limit and sandbox options an embedder configures Espresso, the Java-on-Truffle implementation, and the language runtimes shipped with the distribution The Substrate VM: its garbage collector, its threading and its isolate boundary JNI, the C API and the foreign-function paths where native code and managed code meet The build tooling: native-image itself, the tracing agent that records reflection configuration, and the Maven and Gradle plugins that drive them The gu component installer and anything else in the distribution that fetches and installs code Out of scope Execution of untrusted or adversarial code as a threat model, which Oracle states it does not currently support GraalVM Enterprise and Oracle's commercial JDK builds where the defect does not reproduce on the Community Edition Spring Boot, Quarkus, Micronaut and Helidon themselves, each a separate project with its own process OpenJDK defects that reproduce on a stock JDK, which belong to the JDK's own process even though GraalVM inherits them LLVM defects, as distinct from GraalVM's use of LLVM Anything Oracle has already addressed in a prior Critical Patch Update Most-valued findings JIT miscompilation that removes a bounds check, a null check or a type check the source required. This is the highest-value class here and the hardest for anyone outside the project to find Native Image build-time defects where reflection configuration, substitutions or reachability analysis let something into the final binary that should not be there. The result ships to production and never gets re-analysed Image heap contents that carry build-machine secrets into a distributed binary, an exposure with no equivalent on a normal JVM Cross-language type confusion in Truffle's interoperability layer, where a value produced by one guest language is trusted by another Isolate and sandbox boundary escapes in the Substrate VM. Keep Oracle's stated position on untrusted code in mind and frame the impact for an embedder that relies on the boundary in a trusted-code deployment Memory safety in the Substrate VM runtime, in JNI handling and in the foreign-function paths, all of them native code inside a managed process Anything in the build tooling that executes attacker-controlled code during a native-image build, since that build machine holds the artifacts that get signed Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Email [email protected] , the address oracle/graal 's SECURITY.md points to, and encrypt with the published Oracle PGP key Read Oracle's position on untrusted code before you spend a week on a sandbox escape. The project states it does not currently support the execution of untrusted or adversarial code, so a finding that assumes hostile code is already running can be declined as out of model Fixes ship on Oracle's quarterly Critical Patch Update, in January, April, July and October. Plan for months The reward is a credit line in the CPU advisory. Oracle runs no bug bounty and there is no severity at which that changes Say whether the finding is in GraalVM itself or in the JDK underneath it. Those route differently inside Oracle and a misfiled report stalls Reporting to Oracle is slow and low-touch by reputation. Keep your own dated record of the exchange, because the process gives very little back Reproduce on the Community Edition specifically. A finding only present in the commercial builds is a different product Disclosure Coordinated by email with Oracle's security alerts team and disclosed in a quarterly Critical Patch Update or a Security Alert, with the reporter credited by name. The cadence is fixed at January, April, July and October, so the embargo is set by the next CPU date rather than negotiated. Expect a long, quiet wait and very little status in between. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability