libssh2

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Separately, for a merged upstream patch : up to $5,000 Google Patch Rewards pays on the Tier 2 row, which libssh2 reaches through its OSS-Fuzz integration, for a patch you get accepted upstream and that stays merged, without reverts, for one month, not for the report. The Tier 2 column runs from $100 for a one-liner to $5,000 for a complicated, high-impact change, and the memory-safety multiplier is Tier 1 only, so it does not apply here. The patch must be at least one month and under twelve months old, it is rate-limited to three submissions a person a month, the maintainers hold a veto, and sanctions and territory exclusions apply. Latest advisories Loading the feed Overview libssh2 is the other SSH library, unrelated to libssh despite the name, and it is a client implementation. curl uses it for SCP and SFTP transfers, and it is vendored into Git tooling and a long tail of automation and embedded firmware. It is almost always used to connect outward to a server the caller does not control, and every byte it parses during the handshake arrives before the client has decided whether to trust that server. A memory-safety defect in the transport layer is reachable by any host a target can be induced to connect to, including one reached by a redirected or attacker-supplied URL. The project pays nothing for a report, so sorona.xyz pays you directly on qualified, reproduced findings. In scope SECURITY.md directs reports to GitHub private vulnerability reporting on libssh2/libssh2 , and the object is the upstream tree rather than a vendored copy. Nothing narrower is carved out of it, and everything below sits inside it Client-side handling of server-supplied packets during banner exchange, key exchange and algorithm negotiation, all of which happen before the host key has been checked The transport layer in full: packet length, padding and MAC handling, where a value taken off the wire drives a read, a copy or a decompression Host key handling and known_hosts parsing, including the comparison that decides whether the server on the other end is the one the caller meant to reach The userauth methods in full, covering public key, keyboard-interactive, password and agent-backed, and the paths that report authentication success back to the calling application The channel, SFTP and SCP client layers, where a server controls packet sizes, request identifiers, filenames and attribute records after the session is established Private key file parsing and agent forwarding, where key material is read from disk or brokered to a remote peer Out of scope libssh, which is a different project with a different codebase despite the similar name, and has its own upstream and its own scope row curl's use of libssh2: a defect in how curl drives the library belongs with curl, which has its own entry Defects that actually live in a linked crypto backend such as OpenSSL, mbedTLS, libgcrypt or WinCNG rather than in libssh2 Application-side API misuse: an embedding application that skips the host-key check or ignores a return value and reports the consequence One-line fixes for non-exploitable crashes, which the Patch Rewards rules will not reward, including crashes that come from resource exhaustion Patches the maintainers decline, patches under one month or over twelve months old, and anything past three submissions a person a month Most-valued findings Memory corruption in the transport or handshake layer driven purely by a malicious server, the top bug class here at 43% and one that reaches every consumer that can be pointed at an attacker-chosen host A parsing flaw in packet, attribute or key handling where a wire-supplied length reaches a copy, since that is the mechanism behind most of this library's history Host-key verification failure, which quietly makes an interceptable connection look authenticated to everything built on top of it An authentication path that reports success to the calling application when the server never actually authenticated it A systemic hardening patch across the packet-parsing surface rather than one instance. That is what the top of the Patch Rewards scale is written for, and one-liner crash fixes are explicitly excluded from it Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report privately through GitHub's private vulnerability reporting on libssh2/libssh2 as SECURITY.md directs, with a detailed reproduction; an unreproducible report is not eligible Show the bug against upstream libssh2 rather than against a vendored copy a downstream project carries Give the maintainer room to ship a release and publish an advisory before any public writeup Findings that actually live in libssh, OpenSSH, curl or a linked crypto backend belong upstream with that project rather than here The Google patch money is a separate pathway: you land the fix upstream yourself and keep it merged, without reverts, for one month, and at Tier 2 there is no memory-safety multiplier Google cannot pay anyone on a sanctions list, in a sanctioned territory, or located in Russia or Belarus Disclosure Coordinated with the libssh2 maintainer through GitHub's private vulnerability reporting, which becomes a published advisory with a CVE and researcher credit once a release carrying the fix is out. Downstream consumers that vendor libssh2, curl in particular, need that release before the detail is public, so hold it until then. Nothing in the Patch Rewards rules restricts who may help you prepare or route the report. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability