OpenJDK

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 17 Last 12 months 786 Lifetime Denial of service 70 % Auth bypass 26 % Latest advisories Loading the feed Overview OpenJDK runs a coordinated vulnerability disclosure program through the OpenJDK Vulnerability Group (backed by Oracle) but pays no bounty of its own. Report qualifying findings through sorona.xyz and we pay you directly once a bug is reproduced and validated, with up to 2x the base reward for hard, chained exploits. OpenJDK is the reference implementation of the Java SE platform: the HotSpot virtual machine and JIT compilers, the core class libraries, and the security and cryptography stack (JCA/JCE, TLS, PKI, authentication), so memory-safety, sandbox-escape, deserialization, and crypto flaws all carry real weight here. In scope HotSpot JVM: the bytecode verifier, the C1 and C2 JIT compilers, the interpreter, class-file parsing, the JNI boundary, and the garbage collectors, for memory-safety and sandbox-escape bugs. core-libs: java.io, java.nio, java.lang, and java.util (collections, plus zip and jar via java.util.zip and java.util.jar), object serialization through java.io.ObjectInputStream and its deserialization gadget surface, java.lang.invoke, and java.util.regex (ReDoS). security-libs owned by the OpenJDK Security Group: the JCA/JCE providers (SunJCE, SunEC, SunRsaSign), TLS/JSSE (SunJSSE handshake, session, renegotiation, and cert path), PKI and CertPath validation with OCSP and CRL revocation, java.security access control and permissions, JAAS, Kerberos and GSS-API (sun.security.krb5), SASL, XML Digital Signature (javax.xml.crypto), and keystore/PKCS handling. JAXP and XML processing (com.sun.org.apache.xerces, xalan) for XXE, entity expansion, and XSLT issues. 2D and imaging (java.awt, ImageIO, and the font and image decoders) that natively parse untrusted image or font data. Networking (java.net, the HTTP/HTTPS client, URL and URI handling, sun.net), and RMI or JMX remoting where remotely reachable. Client, AWT/Swing, Sound, and the deploy and serialization surfaces historically abused for sandbox escape. Applies to actively maintained JDK update trains (8u, 11u, 17u, 21u, 25u) and the current feature release. Out of scope Defense-in-depth hardening improvements, which are explicitly not assigned CVEs, though they may still be fixed. Security features of downstream or third-party JDK builds and vendor-specific additions, which go to that vendor. Issues in end-of-life update trains that no longer receive security updates. Flaws that require already-privileged local access or attacker-controlled launch flags or classpath, equivalent to already owning the process. Pre-existing intended behavior of privileged APIs used as designed. Pre-disclosure or public discussion of an unfixed issue: the vulnerability group works privately and expects reports through its channel first. Most-valued findings Sandbox and SecurityManager escapes and in-JVM privilege escalation via Java-level type confusion, reflection or MethodHandle bypass, and deserialization gadget chains. Native memory-safety bugs in HotSpot and native library code: buffer overflow, out-of-bounds access, use-after-free, and integer overflow in image, font, and media decoders or zip inflation. Remote or arbitrary code execution, including via unsafe deserialization. Cryptographic weaknesses: TLS/JSSE handshake, downgrade, and padding-oracle flaws, signature-verification or PKI CertPath validation bypass, weak or predictable RNG, and timing side channels. XXE and entity-expansion DoS in JAXP, plus algorithmic-complexity DoS such as regex ReDoS, zip bombs, and unbounded allocation. Information disclosure across a trust boundary and authentication or authorization bypass in JAAS, Kerberos/GSS, or the access-control checks. Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Submit through sorona.xyz with a clear proof-of-concept and the exact java -version output for the affected build Include crash logs, stack traces, and the relevant environment and configuration details so the issue can be reproduced Test only against your own builds and instances; never target shared or production infrastructure One distinct root cause per report; group variants of the same underlying flaw together Keep vulnerability details confidential until a coordinated fix ships and the embargo lifts Do not access, modify, or exfiltrate data that is not yours while validating a finding Disclosure OpenJDK publishes fixes on a fixed quarterly cadence (January, April, July, and October, on the third Tuesday), and details stay embargoed until the corresponding update is publicly released. Coordinate any publication with sorona.xyz and the OpenJDK Vulnerability Group so disclosure aligns with the patch release. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability