mvfst

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Minimum award, where Meta pays a bounty at all │ $500 │ $625 Maximum: discretionary, no published ceiling for open source │ not published │ not published Submit a vulnerability CVE history 0 Last 12 months 2 Lifetime Denial of service 40 % Memory safety 30 % Parsing/validation 20 % Info disclosure 5 % Latest advisories Loading the feed Overview mvfst is Meta's QUIC implementation and carries a very large share of Meta's client traffic: Meta was one of the earliest large-scale QUIC deployers. As with Proxygen, its external adoption is far smaller than its traffic volume, and as with Proxygen the research value is that it is one of only a handful of independent production QUIC stacks, so a finding here often reproduces elsewhere. What makes it the best reachability profile in this whole program is the protocol itself: QUIC bugs tend to be state-machine and packet-parsing bugs reachable pre-handshake by any remote party, with no credentials and no prior relationship required. Only two CVEs exist against it to date, CVE-2021-24029 and the CVE-2025-30403 heap-buffer-overflow fixed in v2025.07.07.00. Meta pays cash for a report on its own bug bounty with a published minimum of $500, determines severity itself, and publishes no payout guideline covering open source, so no maximum is stated in advance. sorona.xyz adds 1.25× on top of whatever Meta awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Meta declares its open-source scope as GitHub organisation prefixes. The scope table's Open source row lists https://github.com/facebook/ and https://github.com/facebookincubator/ as eligible code repos, and facebook/mvfst sits under the first, so the repository is in scope in full. The row sets no severity cap and Meta publishes no payout guideline covering open source The QUIC transport in full, client and server: connection setup, the connection and stream state machines, and the API the library presents to an application Packet handling: long and short header decoding, version negotiation, coalesced packets, packet-number decoding and header protection Frame parsing and processing across the whole frame set, STREAM, ACK, CRYPTO, NEW_CONNECTION_ID and PATH_CHALLENGE among them, including transitions a peer forces out of order Flow control, stream limits, loss recovery and the congestion controllers the repository ships Connection ID management, retry, stateless reset, address validation and the anti-amplification limits Early data and session resumption, replay behaviour included, plus the boundary between mvfst and the fizz-supplied cryptography beneath it Datagram support, the transport hooks an HTTP/3 layer such as Proxygen's builds on, and the sample servers and tooling in the repository Out of scope Repositories outside those two prefixes. The same scope row names https://github.com/facebookarchive/ as ineligible, and neither facebookresearch/ nor the react/ org that React and React Native moved into appears on the eligible list Extremely low-risk issues, which Meta states may not qualify for a bounty at all Findings with no demonstrated impact on Meta users or systems, since that is what Meta scores a report on Duplicates. Meta pays the first reporter only Awards that sanctions screening blocks: Meta verifies every bounty is permitted under US trade sanctions and economic restrictions Cryptographic defects that belong to fizz, which supplies mvfst's TLS 1.3 layer and has its own entry under the same program Behaviour RFC 9000 or RFC 9001 mandates that you disagree with, which is a specification complaint rather than an implementation vulnerability Volumetric flooding that costs the attacker roughly what it costs the defender Most-valued findings Memory corruption reachable from a datagram sent before the handshake completes, needing no credentials of any kind and the shortest route to the code-execution rung Meta reserves the top of its discretionary band for State-machine confusion that lets a peer drive the connection into an invalid state and then read or write memory it should not reach An asymmetric denial of service where a cheap packet costs the server a great deal. Denial of service is 40% of the expected distribution and the classic QUIC finding Address-validation or anti-amplification bypass that turns the server into a reflector for someone else's traffic A transport-level defect that reproduces against other QUIC implementations, since an independent stack is worth the most to the ecosystem when its bugs generalise Two CVEs exist to date and none landed in the last twelve months, so there is almost no history to steer from. Take the reachability as the guide instead: QUIC parsing runs before any authentication at all Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. File through the report form at bugbounty.meta.com; Meta asks that you not contact its staff directly or through any other channel about a report Awards are entirely at Meta's discretion and Meta determines severity: no published payout guideline covers open source Duplicates pay only the first reporter Meta scores a report on impact to Meta users and systems, so a packet sequence that works against a default mvfst server configuration is worth more than one requiring settings Meta would not run Only repositories under https://github.com/facebook/ and https://github.com/facebookincubator/ are eligible; facebook/mvfst qualifies under the first, while the fizz TLS layer it depends on lives under the second Awards are subject to sanctions screening; Meta verifies that every bounty is permitted under US trade sanctions and economic restrictions Disclosure Coordinated with Meta, on Meta's clock. Its terms ask for reasonable time to investigate and mitigate before you disclose publicly or share the report with others, Meta alone judges what is reasonable, and Meta reserves the right to publish reports and their updates itself. A transport-level defect that reproduces against other QUIC stacks will also want a multi-vendor coordination path, but Meta's window comes first. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability