open62541

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Separately, for a merged upstream patch : up to $5,000 Google Patch Rewards pays for a patch you land upstream yourself and that stays merged, without reverts, for one month, not for the report. This project sits in Tier 2, where awards run from $100 to $5,000; the $15,000 headline is the Tier 1 column and is not reachable here. Patches must be between one and twelve months old, submissions are capped at three per person per month, memory-safety hardening can carry a 2× or 3× multiplier, and sanctions and territory exclusions apply. CVE history 3 Last 12 months 6 Lifetime Memory safety 40 % Parsing/validation 35 % Denial of service 14 % Auth bypass 8 % Latest advisories Loading the feed Overview open62541 is the leading open-source OPC UA stack, and OPC UA is the machine-to-machine protocol at the centre of Industry 4.0. It is embedded in PLCs, industrial PCs, edge gateways, robot controllers, CNC machines and MES integration layers, and MPL-2.0's file-level copyleft puts it inside several commercial products too. A decode bug is remotely reachable on the factory network from anything that can open a TCP session to port 4840, against equipment that is rarely patched and often cannot be taken offline. The CVE record is thin and source-dependent, six by keyword with three in the last year, which is very low relative to the size and exposure of this codebase. Reports go to [email protected] and earn nothing, so sorona.xyz pays you directly on qualified, reproduced findings. In scope Reports go to the maintainer list at [email protected] , against the open62541 stack itself. Defects in the TLS library underneath belong upstream; what counts here is open62541's own use of it The whole binary encoding and decoding layer around UA_decodeBinary , which is both the main fuzz target and the main remotely reachable surface The transport and channel layer in full: TCP connection handling, SecureChannel establishment and renewal, message chunking and reassembly, and message-size limit enforcement The complete server implementation, covering the session and subscription lifecycle, MonitoredItems, method calls and every service the server exposes The client implementation, which parses responses from a server it does not control The whole security layer: certificate validation, the trust-list handling behind it, and the security policies built on mbedTLS or OpenSSL (Basic256Sha256, Aes128Sha256RsaOaep) PubSub over UDP and MQTT, together with the JSON encoding path used alongside the binary one The Nodestore and the address space, including the browse and query handlers an unauthenticated client can drive Out of scope Defects in the underlying TLS library itself rather than in open62541's use of it Configuration and deployment problems in a product that embeds open62541, as distinct from the stack's own code Crash-only one-liners, which Google explicitly declines to reward on the patch rail Patches over twelve months old, which Patch Rewards will not consider For the Google money specifically, anything reported but never patched upstream: that pathway pays only on a merge Most-valued findings Memory corruption in UA_decodeBinary or chunk reassembly reachable from an unauthenticated TCP session to port 4840, the class carrying 40% of this project's history and the one that turns factory-network access into control of a controller SecureChannel or session-establishment flaws that let a peer skip authentication, reuse a channel, or act with a security policy weaker than the one the server believes is in force Certificate validation failures that make an untrusted client or server certificate verify, which collapses the only identity check on the wire Resource-exhaustion paths through subscriptions, MonitoredItems or oversized chunks that stop a running server, since availability is the primary security property in an industrial control setting Decoder bugs in the PubSub and JSON paths, which are newer, less exercised than the binary encoding, and reachable over UDP and MQTT where no session exists at all Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Send a detailed, reproducible report with the packet capture or encoded message that triggers it, and name the build options and TLS backend you used One vulnerability per report unless a chain is needed to show the real impact Bugs that actually live in mbedTLS or OpenSSL belong upstream with those projects. What counts here is open62541's own use of them Give the maintainers room to ship a fix before any public writeup; the devices running this code are industrial and slow to update If you also want the Google patch money, land the fix upstream yourself and keep it merged without reverts for a month. The patch must be between one and twelve months old and you may submit at most three a month Google cannot pay researchers on sanctions lists, in sanctioned territories, or located in Russia or Belarus Disclosure Coordinated with the maintainers through [email protected] . The project has published no GitHub advisories, so agree a timeline explicitly and expect the practical embargo to be governed by how long industrial operators need to roll a firmware update rather than by a fixed clock. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability