MsQuic

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical - deserialization of untrusted data or code injection, high-quality report │ $15,000 │ $16,000 Critical - authentication issues, improper access control, SSRF, or SQL and command injection │ $12,000 │ $13,000 Important - deserialization of untrusted data or code injection │ $10,000 │ $11,000 Critical - XSS, CSRF, cross-origin access, improper input validation, web misconfiguration │ $8,000 │ $9,000 Important - authentication issues, improper access control, SSRF, or SQL and command injection │ $6,000 │ $7,000 Critical - GitHub Actions in the repository │ $5,000 │ $6,000 Important - XSS, CSRF, cross-origin access, improper input validation, web misconfiguration │ $4,000 │ $5,000 Important - GitHub Actions in the repository │ $3,000 │ $3,750 Moderate and Low, every vulnerability type │ $0 │ $0 Submit a vulnerability CVE history 1 Last 12 months 4 Lifetime Denial of service 45 % Memory safety 25 % Code execution 20 % Parsing/validation 5 % Latest advisories Loading the feed Overview MsQuic is Microsoft's production QUIC and HTTP/3 implementation, not a research prototype: it ships inside Windows and Windows Server as the transport behind SMB over QUIC and HTTP/3 in the platform HTTP stack, it is the native QUIC provider for .NET's System.Net.Quic so ASP.NET Core's HTTP/3 support runs on it, and it carries high-volume Microsoft service and console traffic. Because QUIC terminates before any application-layer authentication happens, a parsing or state-machine defect here is pre-authentication and remotely reachable on internet-facing Windows infrastructure, which is the most valuable bug shape in this niche outside ASP.NET Core itself. Microsoft pays it through the MSRC Researcher Portal on the Open Source Bounty Program with a $15,000 top band, though the published grid lists no memory-corruption or remote-code-execution row, so a memory-safety finding is priced against the nearest listed class at Microsoft's discretion. sorona.xyz adds 1.25x on top of whatever Microsoft awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope The whole of microsoft/msquic , which the program names on its SCOPE list as "Msquic", at Critical or Important severity on the most recent actively maintained branch, provided the finding is remotely reachable The QUIC transport state machine: connection establishment, version negotiation, connection ID handling and migration Packet parsing, header protection and AEAD decryption paths, all of which run on bytes from an unauthenticated peer Loss recovery, congestion control, and flow-control and stream-limit accounting Stream multiplexing, stream state and reset handling, and the datagram extension TLS 1.3 handshake integration across both the schannel and OpenSSL back ends, including certificate validation and session resumption The platform abstraction layer: the Windows, Linux and macOS datapaths, the kernel-mode driver, and the UDP socket and receive paths The public MsQuic API, the HTTP/3 framing surface it exposes to consumers, and the repository's own release GitHub Actions workflows Out of scope Findings whose impact stays on the local machine, since MsQuic sits outside the carve-out Microsoft grants to VS Code, Agent Framework, TypeScript, Monaco Editor and PowerShell Defects that actually live in schannel or OpenSSL rather than in MsQuic's use of them The same defect reached through the Windows inbox QUIC stack, which routes to Windows servicing rather than to this program Microsoft repositories outside the program's fifteen-entry SCOPE list: the standard SECURITY.md pointing at MSRC is a reporting path and funds nothing Interoperability quirks with other QUIC stacks that carry no security consequence Moderate and Low severity, which pay $0 at every report quality Samples, tutorials and quickstart code Publicly disclosed issues and dependency-confusion reports Reports Microsoft cannot pay out on: residency in a sanctioned country, or no IRS tax form returned within 30 days of validation, voids the award Most-valued findings Pre-authentication memory corruption in packet parsing or the handshake path, reachable from an unauthenticated peer before TLS completes: the highest-impact shape here, priced at Microsoft's discretion against the nearest listed class because the published grid has no memory-safety row Header-protection or AEAD decryption handling that accepts a packet it should reject, or that decrypts into the wrong connection's state A transport state-machine or connection-migration flaw that lets one peer take over, redirect or confuse an established connection Remotely triggered resource exhaustion through flow-control, stream-limit or loss-recovery accounting: MsQuic's own CVE history sits here, and it maps to the improper-input-validation band Stream multiplexing or reset handling that leaks one stream's data into another, since QUIC consumers assume stream isolation holds Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. The finding must be remotely reachable: MsQuic is not in the program's local-machine carve-out, so local-only impact is excluded Only Critical and Important severity qualify; Moderate and Low findings pay $0 under this program Reproduce on the most recent actively maintained branch The same defect reached through the Windows inbox QUIC stack may be routed to Windows servicing rather than paid here, so show it against the open-source library Follow coordinated vulnerability disclosure: Microsoft requires bounty submissions stay confidential while it fixes, and imposing a fix deadline forfeits eligibility Return an IRS tax form (W-9, W-8BEN or 8233) within 30 calendar days of validation, and expect sanctions screening Disclosure Coordinated through MSRC. This repository has an unusually consistent record of publishing its own GitHub security advisories with researcher credit once a fix ships, so expect a real public artefact on Microsoft's timeline. Microsoft requires submissions stay confidential until that fix ships, so hold the detail until the advisory is out. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability