Gson

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Product vulnerability (Tier OT0; supply-chain compromise is a separate category) │ $500 - $7,500 │ $625 - $8,500 Other security issue (Tier OT0 flat award) │ $1,000 │ $1,250 Submit a vulnerability CVE history 0 Last 12 months 1 Lifetime Parsing/validation 40 % Denial of service 30 % Code execution 20 % Info disclosure 5 % Latest advisories Loading the feed Overview Gson is the default JSON library of the Android ecosystem and a very common choice in server-side Java, bundled into an enormous number of Android applications, into Retrofit-based mobile API clients, into Minecraft and its mod ecosystem, and across enterprise Java. That places it directly on the untrusted-input boundary of hundreds of millions of mobile devices, because mobile apps routinely feed remote JSON straight into fromJson with no intermediate validation. A parser-level flaw here is remotely reachable on the client side at genuinely global scale, and Google rates it Tier OT0 on the Bug Hunters open-source VRP for exactly that reason, paying $500 to $7,500 for a product vulnerability in the project's own code at a panel's discretion. sorona.xyz adds 1.25× on top of whatever Google awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope google/gson is named at OT0 in Google's tier file, and it sits in a Google-owned GitHub organisation, which the program's scope sentence covers as well. A product vulnerability anywhere in the library is priced at $500 to $7,500 JsonReader in both lenient and strict modes, including deeply nested, truncated and otherwise malformed input, and the streaming JsonWriter on the other side Gson.fromJson and toJson , and the TypeAdapter resolution that decides which adapter runs for a given target type ReflectiveTypeAdapterFactory and how it interacts with arbitrary target classes, including their fields, setters and the Unsafe allocation fallback used when a class has no usable constructor JsonParser , the JsonElement tree model, and JsonObject key handling such as duplicate and colliding keys The built-in adapters for numbers, dates, Enum , collections, maps and java.time types, and their coercion behaviour when the incoming value does not match the declared type TypeToken and the generic type resolution that decides what a parameterised target actually deserialises into GsonBuilder configuration, custom serialisers and deserialisers, @JsonAdapter , and the field naming and exclusion strategies Release publishing to Maven Central, which falls under the supply-chain reward category Out of scope Deserialisation gadget chains that live in the application's own classpath rather than in Gson Applications that choose to call fromJson on untrusted data into unsafe target types Object -typed deserialisation, which the project documents as unsafe by design Third-party JSON libraries, including other parsers an application happens to use alongside Gson Behaviour differences from Jackson that carry no independent security impact Repositories the tier file does not name, and releases that are not current: the program covers the latest versions of the listed repositories, and any other repository in the same organisation counts only where the file names it. What the file omits sits at OT2 or OT3, where product vulnerabilities earn no monetary reward Reports filed by anyone other than the researcher: Google requires the submission under your own identity through bughunters.google.com, and treats routing around the designated channel as grounds to reject Awards to researchers on sanctions lists, in territories subject to sanctions, or located in Russia or Belarus, which Google states it will not issue Most-valued findings A fromJson path that reaches code execution without a gadget supplied by the caller: the CVE-2022-25647 writeReplace shape, code execution being 20% of Gson's history and by far the class most likely to reach the top of the $7,500 band JsonReader parsing flaws driven purely by attacker-supplied bytes, since parsing and validation is 40% of the history and this is the surface every mobile client exposes to a remote server Type-adapter or coercion confusion that lets a value land in a field of a type the application believed it had constrained, which turns a schema assumption into an exploitable one Unbounded recursion or allocation from a small, deeply nested document, the classic denial-of-service shape at 30% and one that reaches every device that parses a response ReflectiveTypeAdapterFactory behaviour that touches fields or methods the target class never intended to be reachable from deserialisation Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. The repo is rated TIER_OT0, where product vulnerabilities cap at $7,500; the $31,337 ceiling requires a supply-chain compromise of the repository or release pipeline, which is a different reward category Gson is pure Java, so no OSS-Fuzz reproduction is required: a reproducible test case against a released artifact is the right proof The award is set by a discretionary panel, so the band is a range rather than a fixed table and a report that spells out real impact is what moves you up it The defect has to live in Gson: a gadget chain assembled from classes on the application's own classpath is the application's problem, not the parser's Take the flaw to Google before anyone else: the VRP treats private disclosure to a third party for purposes other than fixing the bug as grounds to refuse the reward Disclosure Coordinated through Google Bug Hunters, with the fix shipping in a Gson release and an advisory published against the com.google.code.gson:gson Maven coordinate. Because the program's rules can be read as barring a third-party hand-off before the fix, file with Google directly and hold the detail until the release is out; the mobile install base upgrades slowly and needs the lead time. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability