- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 9
- Public CVEs
- 107
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
9 assets you may test, 6 excluded.
Web 1
- https://gitlab.gnome.org/GNOME/libxml2
Products and areas 8
- Canonical XML (c14n) serialization and the HTML parser (htmlParse) code paths
- Defects reachable through the xmllint command-line front end
- Document parsing of untrusted XML through the xmlReadFile, xmlReadMemory, xmlReadDoc, and xmlParseFile family and related APIs
- DTD handling and entity processing, covering internal and external entities and entity-reference expansion, plus DTD validation
- Reader, writer, and tree memory management around parsed documents, including character-encoding conversion
- The core XML parser entry points, including the SAX and SAX1 callback interfaces, the push parser, and the xmlReader streaming interface
- The XPath 1.0 evaluation engine and XInclude 1.0 processing
- XML Schema 1.0 (XSD) and RELAX NG validation, and Schematron processing, where several recent use-after-free and denial-of-service advisories have landed
Out of scope (6)
- Bugs already public in the issue tracker or already fixed in a newer release
- Crashes reachable only through deliberately unsafe or non-default build options
- Feature requests reframed as security issues, or purely theoretical claims with no reproducer or realistic attack path
- Findings in third-party bindings, packagers, or downstream forks rather than upstream libxml2
- Missing compiler hardening, best-practice suggestions, or static-analyzer noise with no demonstrated impact
- Reports that reduce to feeding untrusted data to a library its own README warns is not built to process it, absent a distinct memory-safety or logic flaw
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
Submit a minimal reproducer: the triggering document plus the exact API call or xmllint invocation
-
Test against a current release or the master branch before reporting
-
Include affected version, build configuration, and observed versus expected behavior
-
One distinct root cause per report; do not bundle unrelated bugs
-
Do not run automated fuzzing or load against shared or third-party infrastructure
-
Be respectful of volunteer maintainers and do not pressure anyone over timelines or CVEs
Not accepted
-
Reports that reduce to feeding untrusted data to a library its own README warns is not built to process it, absent a distinct memory-safety or logic flaw
-
Findings in third-party bindings, packagers, or downstream forks rather than upstream libxml2
-
Bugs already public in the issue tracker or already fixed in a newer release
-
Feature requests reframed as security issues, or purely theoretical claims with no reproducer or realistic attack path
-
Missing compiler hardening, best-practice suggestions, or static-analyzer noise with no demonstrated impact
-
Crashes reachable only through deliberately unsafe or non-default build options
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-102559 | A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow. | High 8.6 | 29 Sep 2026 |
| CVE-2026-102560 | A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow. | High 8.6 | 29 Sep 2026 |
| CVE-2026-102555 | A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the size of the returned GBytes. This can lead to an out-of-bounds read or application crash when | High 8.2 | 29 Sep 2026 |
| CVE-2026-102558 | A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame data. | High 8.6 | 29 Sep 2026 |
| CVE-2026-102557 | A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used the full length, leading to heap corruption or a crash. | High 8.6 | 29 Sep 2026 |
| CVE-2026-102556 | A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a crash upon receiving a crafted Pong. | High 8.6 | 29 Sep 2026 |
| CVE-2026-66337 | A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client application to crash or disclose sensitive heap memory. | Medium 6.5 | 24 Jul 2026 |
| CVE-2026-66338 | A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts inputs violating RFC 9112, including leading whitespace, plus sign prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, this parsing differential can be exploited to smuggle HTTP requests. | Medium 5.4 | 24 Jul 2026 |
| CVE-2026-66339 | A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure. | Medium 6.5 | 24 Jul 2026 |
| CVE-2026-12548 | A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents. | Medium 4.2 | 21 Jul 2026 |
| CVE-2026-58014 | A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary. | High 7.3 | 30 Jun 2026 |
| CVE-2026-58015 | A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a | Medium 5.9 | 30 Jun 2026 |
| CVE-2026-58016 | A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of s | High 7.5 | 30 Jun 2026 |
| CVE-2026-58010 | A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses > instead of >=, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information disclosure of 1 byte and a denial of service when the out-of-bounds read crosses a page boundary. | Medium 6.5 | 30 Jun 2026 |
| CVE-2026-58011 | A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the g_date_time_add_full function is processed. This flaw can corrupt the date output and potentially cause logic errors that may lead to a denial of service. | Medium 6.5 | 30 Jun 2026 |
| CVE-2026-58012 | A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This vulnerability can cause a minor information disclosure of 1-5 b | Medium 6.5 | 30 Jun 2026 |
| CVE-2026-58013 | A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary. | Medium 6.5 | 30 Jun 2026 |
| CVE-2026-13601 | A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak's intended sandbox isolation, allowing Yelp to evaluate local XML in | High 7.1 | 29 Jun 2026 |
| CVE-2026-12549 | The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed comparison. When a client sends a Range request with a suffix length exceeding the content size, the resulting negative start value is not properly clamped, leading to malformed HTTP 206 responses and log flooding. | Medium 4.8 | 22 Jun 2026 |
| CVE-2026-1766 | A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor, specifically within the tracker-extract-mp3 component. This heap buffer overflow vulnerability occurs when processing specially crafted MP3 files containing malformed ID3v2.3 COMM (Comment) tags. An attacker could exploit this by providing a malicious MP3 file, leading to a denial of service (DoS), which caus | Medium 5.6 | 16 Jun 2026 |
| CVE-2026-1767 | A flaw was found in the GNOME localsearch (previously known as tracker-miners) MP3 Extractor `tracker-extract-mp3` component. A remote attacker could exploit this heap buffer overflow vulnerability by providing a specially crafted MP3 file containing malformed ID3 tags. This incorrect length calculation during the parsing of performer tags can lead to a read beyond the allocated buffer, potentiall | Medium 5.6 | 16 Jun 2026 |
| CVE-2026-1764 | A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor. When processing specially crafted MP3 files containing ID3v2.4 tags, a missing bounds check in the `extract_performers_tags` function can lead to a heap buffer overflow. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by triggering a read of unmapped memory. In some cases, it co | Medium 5.6 | 16 Jun 2026 |
| CVE-2026-2708 | A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values. | Low 3.7 | 23 Apr 2026 |
| CVE-2026-5201 | A flaw was found in the gdk-pixbuf library. This heap-based buffer overflow vulnerability occurs in the JPEG image loader due to improper validation of color component counts when processing a specially crafted JPEG image. A remote attacker can exploit this flaw without user interaction, for example, via thumbnail generation. Successful exploitation leads to application crashes and denial of servi | High 7.5 | 31 Mar 2026 |
| CVE-2026-5119 | A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation. | Medium 5.9 | 30 Mar 2026 |
| CVE-2026-2436 | A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free vulnerability where the `soup_server_disconnect()` function frees connection objects prematurely, even if a TLS handshake is still pending. If the handshake completes after the connection object has been freed, a dangling pointer is accessed, leading to a server crash and a Denial of Service. | Medium 6.5 | 26 Mar 2026 |
| CVE-2026-2369 | A flaw was found in libsoup. An integer underflow vulnerability occurs when processing content with a zero-length resource, leading to a buffer overread. This can allow an attacker to potentially access sensitive information or cause an application level denial of service. | Medium 6.5 | 19 Mar 2026 |
| CVE-2026-4271 | A flaw was found in libsoup, a library for handling HTTP requests. This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 server implementation. A remote attacker can exploit this by sending specially crafted HTTP/2 requests that cause authentication failures. This can lead to the application attempting to access memory that has already been freed, potentially causing application inst | Medium 5.3 | 17 Mar 2026 |
| CVE-2026-3633 | A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line construction, potentially leading to HTTP request injection. | Low 3.9 | 17 Mar 2026 |
| CVE-2026-3634 | A flaw was found in libsoup. An attacker controlling the value used to set the Content-Type header can inject a Carriage Return Line Feed (CRLF) sequence due to improper input sanitization in the `soup_message_headers_set_content_type()` function. This vulnerability allows for the injection of arbitrary header-value pairs, potentially leading to HTTP header injection and response splitting attacks | Low 3.9 | 17 Mar 2026 |
| CVE-2026-3632 | A flaw was found in libsoup, a library used by applications to send network requests. This vulnerability occurs because libsoup does not properly validate hostnames, allowing special characters to be injected into HTTP headers. A remote attacker could exploit this to perform HTTP smuggling, where they can send hidden, malicious requests alongside legitimate ones. In certain situations, this could | Low 3.9 | 17 Mar 2026 |
| CVE-2026-3099 | A flaw was found in Libsoup. The server-side digest authentication implementation in the SoupAuthDomainDigest class does not properly track issued nonces or enforce the required incrementing nonce-count (nc) attribute. This vulnerability allows a remote attacker to capture a single valid authentication header and replay it repeatedly. Consequently, the attacker can bypass authentication and gain u | Medium 5.8 | 12 Mar 2026 |
| CVE-2026-2443 | A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. When processing specially crafted HTTP Range headers, the library may improperly validate requested byte ranges. In certain build configurations, this could allow a remote attacker to access portions of server memory beyond the intended response. Exploitation requires a vulnerable configuration and access to a ser | Medium 5.3 | 13 Feb 2026 |
| CVE-2026-1801 | A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soup_filter_input_stream_read_line() logic, where libsoup accepts malformed chunk headers, such as lone line feed (LF) characters instead of the required carriage return and line feed (CRLF). A remote attacker can exploit this without authentication or | Medium 5.3 | 3 Feb 2026 |
| CVE-2026-1536 | A flaw was found in libsoup. An attacker who can control the input for the Content-Disposition header can inject CRLF (Carriage Return Line Feed) sequences into the header value. These sequences are then interpreted verbatim when the HTTP request or response is constructed, allowing arbitrary HTTP headers to be injected. This vulnerability can lead to HTTP header injection or HTTP response splitti | Medium 5.8 | 28 Jan 2026 |
| CVE-2026-1539 | A flaw was found in the libsoup HTTP library that can cause proxy authentication credentials to be sent to unintended destinations. When handling HTTP redirects, libsoup removes the Authorization header but does not remove the Proxy-Authorization header if the request is redirected to a different host. As a result, sensitive proxy credentials may be leaked to third-party servers. Applications usin | Medium 5.8 | 28 Jan 2026 |
| CVE-2026-1467 | A flaw was found in libsoup, an HTTP client library. This vulnerability, known as CRLF (Carriage Return Line Feed) Injection, occurs when an HTTP proxy is configured and the library improperly handles URL-decoded input used to create the Host header. A remote attacker can exploit this by providing a specially crafted URL containing CRLF sequences, allowing them to inject additional HTTP headers or | Medium 5.8 | 27 Jan 2026 |
| CVE-2025-14512 | A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib's GIO (GLib Input/Output) escape_byte_string() function when processing malicious file or remote filesystem attribute values. | Medium 6.5 | 11 Dec 2025 |
| CVE-2025-14087 | A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings. | Medium 5.6 | 10 Dec 2025 |
| CVE-2025-13601 | A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string. | High 7.7 | 26 Nov 2025 |
| CVE-2025-4056 | A flaw was found in GLib. A denial of service on Windows platforms may occur if an application attempts to spawn a program using long command lines. | High 7.5 | 28 Jul 2025 |
| CVE-2025-6196 | A flaw was found in libgepub, a library used to read EPUB files. The software mishandles file size calculations when opening specially crafted EPUB files, leading to incorrect memory allocations. This issue causes the application to crash. Known affected usage includes desktop services like Tumbler, which may process malicious files automatically when browsing directories. While no direct remote a | Medium 5.5 | 17 Jun 2025 |
| CVE-2025-6199 | A flaw was found in the GIF parser of GdkPixbuf’s LZW decoder. When an invalid symbol is encountered during decompression, the decoder sets the reported output size to the full buffer length rather than the actual number of written bytes. This logic error results in uninitialized sections of the buffer being included in the output, potentially leaking arbitrary memory contents in the processed ima | Low 3.3 | 17 Jun 2025 |
| CVE-2025-6052 | A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption. | Low 3.7 | 13 Jun 2025 |
| CVE-2023-5616 | In Ubuntu, gnome-control-center did not properly reflect SSH remote login status when the system was configured to use systemd socket activation for openssh-server. This could unknowingly leave the local machine exposed to remote SSH access contrary to expectation of the user. | Medium 4.9 | 15 Apr 2025 |
| CVE-2025-3155 | A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an external environment. | High 7.4 | 3 Apr 2025 |
| CVE-2025-2784 | A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server. | High 7.0 | 3 Apr 2025 |
| CVE-2022-1736 | Ubuntu's configuration of gnome-control-center allowed Remote Desktop Sharing to be enabled by default. | Critical 9.8 | 31 Jan 2025 |
| CVE-2023-43091 | A flaw was found in GNOME Maps, which is vulnerable to a code injection attack via its service.json configuration file. If the configuration file is malicious, it may execute arbitrary code. | Critical 9.8 | 17 Nov 2024 |
| CVE-2024-52533 | gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a trailing '\0' character. | Critical 9.8 | 11 Nov 2024 |
| CVE-2024-52530 | GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignored, i.e., a "Transfer-Encoding\0: chunked" header is treated the same as a "Transfer-Encoding: chunked" header. | High 7.5 | 11 Nov 2024 |
| CVE-2024-52531 | GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in soup_header_parse_param_list_strict. There is a plausible way to reach this remotely via soup_message_headers_get_content_type (e.g., an application may want to retrieve the content type of a request or response). | Medium 6.5 | 11 Nov 2024 |
| CVE-2024-52532 | GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. during the reading of certain patterns of WebSocket data from clients. | High 7.5 | 11 Nov 2024 |
| CVE-2024-42415 | An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf). A specially crafted file can result in an integer overflow that allows for a heap-based buffer overflow when processing the sector allocation table. This can lead to arbitrary code execution. An attacker can provide a malicious file to tri | High 8.4 | 3 Oct 2024 |
| CVE-2024-36474 | An integer overflow vulnerability exists in the Compound Document Binary File format parser of the GNOME Project G Structured File Library (libgsf) version v1.14.52. A specially crafted file can result in an integer overflow when processing the directory from the file that allows for an out-of-bounds index to be used when reading and writing to an array. This can lead to arbitrary code execution. | High 8.4 | 3 Oct 2024 |
| CVE-2024-34397 | An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client subscribes to signals from a trusted system service such as NetworkManager on a shared computer, other users of the same computer can send spoofed D-Bus signals that the GDBus-based client will wrongly interpret as having been sent by the trusted system service. This could lead to th | Medium 5.2 | 7 May 2024 |
| CVE-2020-36774 | plugins/gtk+/glade-gtk-box.c in GNOME Glade before 3.38.1 and 3.39.x before 3.40.0 mishandles widget rebuilding for GladeGtkBox, leading to a denial of service (application crash). | Medium 5.5 | 19 Feb 2024 |
| CVE-2022-48622 | In GNOME GdkPixbuf (aka gdk-pixbuf) through 2.42.10, the ANI (Windows animated cursor) decoder encounters heap memory corruption (in ani_load_chunk in io-ani.c) when parsing chunks in a crafted .ani file. A crafted file could allow an attacker to overwrite heap metadata, leading to a denial of service or code execution attack. This occurs in gdk_pixbuf_set_option() in gdk-pixbuf.c. | High 7.8 | 26 Jan 2024 |
| CVE-2023-5557 | A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability. | High 7.5 | 13 Oct 2023 |
| CVE-2023-43090 | A vulnerability was found in GNOME Shell. GNOME Shell's lock screen allows an unauthenticated local user to view windows of the locked desktop session by using keyboard shortcuts to unlock the restricted functionality of the screenshot tool. | Medium 5.5 | 22 Sep 2023 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 8 Last 12 months 107 Lifetime Memory safety 45 % Denial of service 38 % Code execution 9 % Info disclosure 8 % Latest advisories Loading the feed Overview libxml2 runs a vulnerability disclosure program with no bounty of its own. Report your finding through sorona.xyz and we pay you directly for qualified, reproduced issues, up to 2x the base reward for hard, chained bugs. libxml2 is the C XML toolkit that originated in the GNOME project and is embedded almost everywhere XML is parsed, from browsers and language runtimes to operating systems, so memory-safety and denial-of-service defects carry broad downstream impact. It is maintained by volunteers and is not intended for processing untrusted input, which makes credible, well-scoped reports especially valuable. In scope The core XML parser entry points, including the SAX and SAX1 callback interfaces, the push parser, and the xmlReader streaming interface Document parsing of untrusted XML through the xmlReadFile, xmlReadMemory, xmlReadDoc, and xmlParseFile family and related APIs DTD handling and entity processing, covering internal and external entities and entity-reference expansion, plus DTD validation The XPath 1.0 evaluation engine and XInclude 1.0 processing XML Schema 1.0 (XSD) and RELAX NG validation, and Schematron processing, where several recent use-after-free and denial-of-service advisories have landed Canonical XML (c14n) serialization and the HTML parser (htmlParse) code paths Reader, writer, and tree memory management around parsed documents, including character-encoding conversion Defects reachable through the xmllint command-line front end Out of scope Reports that reduce to feeding untrusted data to a library its own README warns is not built to process it, absent a distinct memory-safety or logic flaw Findings in third-party bindings, packagers, or downstream forks rather than upstream libxml2 Bugs already public in the issue tracker or already fixed in a newer release Feature requests reframed as security issues, or purely theoretical claims with no reproducer or realistic attack path Missing compiler hardening, best-practice suggestions, or static-analyzer noise with no demonstrated impact Crashes reachable only through deliberately unsafe or non-default build options Most-valued findings Heap use-after-free, the dominant recent class, notably in Schematron and in DTD and entity teardown Out-of-bounds read or write and buffer overflow when parsing crafted XML from an untrusted source Integer overflow that leads to memory corruption Type confusion or invalid pointer handling during tree manipulation Denial of service from crafted documents through unbounded entity expansion, deep nesting, or quadratic parsing behavior NULL-pointer dereference and allocation-failure crashes reachable from untrusted input Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Submit a minimal reproducer: the triggering document plus the exact API call or xmllint invocation Test against a current release or the master branch before reporting Include affected version, build configuration, and observed versus expected behavior One distinct root cause per report; do not bundle unrelated bugs Do not run automated fuzzing or load against shared or third-party infrastructure Be respectful of volunteer maintainers and do not pressure anyone over timelines or CVEs Disclosure Coordinated disclosure through sorona.xyz. libxml2 treats security bugs largely like ordinary bugs and works them on a best-effort basis with no fixed embargo, so sorona.xyz reproduces and reports upstream while keeping details private until a fix ships or the project publishes. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability