- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 9
- Public CVEs
- 294
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
- Hall of fame
-
Yes
The project batches fixes into scheduled releases and publishes its own advisory with researcher credit
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
9 assets you may test, 6 excluded.
Web 1
- https://www.openssl.org
Products and areas 8
- ASN.1 and DER decoding of attacker-supplied certificates, keys, and structures
- Cryptographic implementation flaws with demonstrated impact, including timing and side-channel leakage in supported operations
- Parsing of PKCS containers from untrusted data (PKCS#7, PKCS#8, PKCS#12) and PEM handling
- Reports go privately to the OpenSSL security team at [email protected] and cover OpenSSL's own code; a defect that lives in a bundled dependency goes to that project instead
- The provider and ENGINE interfaces where untrusted configuration or input crosses into library state
- The TLS and DTLS handshake and record layers, covering key exchange, session resumption, renegotiation, and fragment reassembly
- The whole of libcrypto and libssl as reachable from untrusted network peers, including heap and stack overflows, use-after-free, and out-of-bounds reads or writes
- X.509 certificate parsing and chain building, including path validation, name-constraint enforcement, and CRL and OCSP handling, and anything that lets an attacker bypass verification
Out of scope (6)
- Application-side API misuse: ignoring return values, calling functions out of the documented order, or passing invalid parameters
- Attacks that assume the attacker already controls trusted inputs such as private keys or the trusted CA store, which sit inside the trust boundary
- Defects that actually live in a bundled or linked dependency rather than in OpenSSL itself
- Deprecated and legacy interfaces the project has already announced as unsupported
- Issues confined to the command-line utilities rather than the libraries
- Objections to default cipher, protocol, or algorithm selection, which are configuration and policy matters
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz.
-
Send a detailed, reproducible report; if we can't reproduce it, it isn't eligible
-
One vulnerability per report unless a chain is needed to show the real impact
-
Give the OpenSSL security team room to ship a fix before any public writeup
-
Findings that live in a bundled dependency belong upstream with that project rather than here
Not accepted
-
Attacks that assume the attacker already controls trusted inputs such as private keys or the trusted CA store
-
Application-side API misuse: ignoring return values, calling functions out of the documented order, or passing invalid parameters
-
Defects that actually live in a bundled or linked dependency rather than in OpenSSL itself
-
Objections to default cipher, protocol, or algorithm selection
-
Issues confined to the command-line utilities rather than the libraries
-
Deprecated and legacy interfaces the project has already announced as unsupported
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-84782 | Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspended write needs to resume correctly. Impact summary: The retransmitted message can disclose a heap memory to the peer as plaintext handshake d | High 8.2 | 29 Sep 2026 |
| CVE-2026-84783 | Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension data to be freed while another thread is still using it. Impact summary: A remote, unauthenticated peer could crash a multi-threaded TLS client, or a multi-threaded TLS server that requests client certificates, if the first certificate chains built to the same trusted CA certific | High 7.5 | 29 Sep 2026 |
| CVE-2026-84784 | Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a limit check on how many connection IDs the remote QUIC stack can use. Impact summary: The local QUIC stack sends a RETIRE_CONN_ID frame for every NEW_CONNECTION_ID frame it receives. The RETIRE_CONN_ID frame is dispatched via the Control Frame Queue (CFQ). If the remote peer also withh | High 7.5 | 29 Sep 2026 |
| CVE-2026-75804 | Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the QUIC stack receive ~100MB of memory instead of 768 KiB (default flow control window size). CWE: CWE-77 | Medium 5.3 | 29 Sep 2026 |
| CVE-2026-75805 | Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. Impact summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial of Service for the affected client application. CWE: CWE-476: NULL-pointer dereference Description: A C | Medium 5.3 | 29 Sep 2026 |
| CVE-2026-75806 | Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted fragment is shorter than the mandatory explicit IV and authentication tag overhead. Impact summary: An attacker who can send a datagram that is routed to an existing DTLS 1.2 association can tear that association down without knowing any key material. | Medium 5.3 | 29 Sep 2026 |
| CVE-2026-77696 | Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidden Number Problem attack, lead to recovery of the private key. CWE: CWE-208: Observable Timing Discrepa | Low 3.7 | 29 Sep 2026 |
| CVE-2026-72897 | Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part way through a handshake may access memory beyond the end of an internal array if the replacement context knows about more provider signature algorithms than the context the connection was created from. Applications which never call SSL_set_SSL_CTX() are not affected. Impact summary: A remote | High 7.5 | 29 Sep 2026 |
| CVE-2026-54872 | Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secret nonce through timing. Impact summary: An attacker able to measure signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidden Number | Low 3.7 | 29 Sep 2026 |
| CVE-2026-54873 | Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact summary: Remote peer can exploit this vulnerability by sending maliciously crafted packets, making the local QUIC stack to keep the memory for packet buffers allocated. The time for which the memory remains allocated is entirely under the control of the potentially malicious remote peer | High 7.5 | 29 Sep 2026 |
| CVE-2026-54875 | Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms. Impact summary: An attacker able to measure the time taken by, or to observe the cache-line access pattern of SM2 signing or decryption on an affected platform can learn information about the secret scalar. CWE: CWE-208: Observable Timing | Low 3.7 | 29 Sep 2026 |
| CVE-2026-42772 | Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data. Impact summary: A remote QUIC peer that completes the handshake can create a connection-scoped CPU pressure and potentially a Denial of | Medium 5.3 | 29 Sep 2026 |
| CVE-2026-35189 | Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of Service in clients or in servers that solicit client certificates. CWE: CWE-770: Allocation of Resources W | Medium 5.3 | 29 Sep 2026 |
| CVE-2026-35191 | Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of the RFC 9000 unvalidated connection amplification limit of 3 times the amount of data received. Impact summary: A remote attacker able to spoof packets to a server using the OpenSSL QUIC im | Low 3.7 | 29 Sep 2026 |
| CVE-2026-75803 | Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages. CWE: CWE-354 (Improper Validation | Critical 9.1 | 25 Aug 2026 |
| CVE-2026-63076 | Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid pointer. Impact summary: A remote, unauthenticated attacker can crash an application acting as a CMP server | High 7.5 | 25 Aug 2026 |
| CVE-2026-63072 | Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impact summary: An attacker who supplies a crafted CMS message can trigger a deterministic 8-byte out-of-bounds heap write when the victim decryp | High 7.5 | 25 Aug 2026 |
| CVE-2026-63073 | Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate whose subject becomes the default expected sender. CWE: CWE-134 (Use of Externally-Controlled Fo | Critical 9.8 | 25 Aug 2026 |
| CVE-2026-63074 | Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX frequently, this cache of extraCerts may grow unboundedly, and a malicious client may flood a CMP server with requests driving this growth. Impact summary: Users utilizing a | Medium 5.9 | 25 Aug 2026 |
| CVE-2026-63075 | Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC handshake can cause connection-scoped memory growth which may lead to Denial of Service through memory exha | High 7.5 | 25 Aug 2026 |
| CVE-2026-54874 | Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large amount of memory, which may lead to a Denial of Service. CWE: CWE-405: Asymmetric Resource Consumption | High 7.5 | 25 Aug 2026 |
| CVE-2026-14457 | Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted "signature_algorithms_cert" TLS extension. Impact summary: The impact is limited to a possible Denial of S | High 7.5 | 25 Aug 2026 |
| CVE-2026-18798 | Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence that this double free is exploitable for remote code execution, thus it is considered highly improba | High 7.5 | 25 Aug 2026 |
| CVE-2026-14456 | Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the server listener faster than the application accepts connections, can cause the memory allocated to store t | High 7.5 | 13 Aug 2026 |
| CVE-2026-54876 | Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries. Impact summary: An attacker can leak an attacker-tunable amount of memory per TLS handshake in a victim client application. A long-running client that repeatedly connects to a malicious server can have its memory | High 7.5 | 5 Aug 2026 |
| CVE-2026-9076 | Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap) processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher can trigger a heap out-of-bounds read in kek_unwrap_key(). Impact summary: A heap buffer over-read may trigger a crash which leads to Denial of Service for an application if the input buffer ends at a memory page boundary and the following p | High 7.5 | 9 Jun 2026 |
| CVE-2026-7383 | Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap buffer overflow. Impact summary: A heap buffer overflow may lead to a crash or possibly attacker controlled code execution or other undefined behaviour. In ASN1_mbstring_copy() and ASN1_mbstring_ncopy() the destination size for Unicode output is computed in a s | High 8.1 | 9 Jun 2026 |
| CVE-2026-45445 | Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded. Impact summary: Every message encrypted under the same key uses the same effective nonce regardless of the IV supplied by the caller, resulting in (key, nonce) reuse and loss of confidentiality. If the same code | High 7.5 | 9 Jun 2026 |
| CVE-2026-45446 | Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) mishandle the authentication of AAD (Additional Authenticated Data) with an empty ciphertext allowing a forgery of such messages. Impact summary: An attacker can forge empty messages with arbitrary AAD to the victim's application using these ciphers. AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) are nonce-misuse-re | Medium 4.8 | 9 Jun 2026 |
| CVE-2026-45447 | Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution. When processing a PKCS#7 or S/MIME signed message, if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may incorre | High 8.8 | 9 Jun 2026 |
| CVE-2026-42770 | Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the peer key is not properly checked for the subgroup membership. Impact summary: A malicious peer which presents an X9.42 key carrying the victim's p and g parameters, a forged q = r (a small prime factor of the cofactor (p−1)/q_local), and a public value Y of order r can recover the victim's private key after a | Low 3.7 | 9 Jun 2026 |
| CVE-2026-42771 | Issue summary: When the X509_VERIFY_PARAM_set1_email is called by an application to validate a crafted e-mail address, such as during S/MIME message validation, an out of bounds read can happen. Impact summary: This out of bounds read will not directly exfiltrate the data read to the attacker so the most likely result is a crash and a Denial of Service. An internal helper function called from X509 | Medium 6.2 | 9 Jun 2026 |
| CVE-2026-42764 | Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the OpenSSL QUIC server with address validation disabled. Impact summary: NULL pointer dereference typically causes abnormal termination of the affected QUIC server process and a Denial of Service. If the address validation is disabled in the OpenSSL QUIC server implementation, an attacke | High 7.5 | 9 Jun 2026 |
| CVE-2026-42765 | Issue summary: When a partial-chain certificate verification is enabled together with OCSP response checking for the whole chain, a NULL dereference will happen if the verified chain does not have a self-signed trusted anchor, crashing the process. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. When performing OCSP response che | High 7.5 | 9 Jun 2026 |
| CVE-2026-42766 | Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summary: This NULL pointer dereference leads to an application crash and a Denial of Service. The CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as OPTIONAL in the ASN.1 specification and may therefore be absent in specially crafted inputs. Durin | Medium 5.9 | 9 Jun 2026 |
| CVE-2026-42767 | Issue summary: An attacker-controlled CMP (Certificate Management Protocol) server could trigger a NULL pointer dereference in a CMP client application. Impact summary: A NULL pointer dereference causes a crash of the application and a Denial of Service. An attacker controlling a CMP server (or acting as a man-in-the-middle) could craft a CMP response containing a CRMF (Certificate Request Message | Medium 5.9 | 9 Jun 2026 |
| CVE-2026-42768 | Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to Bleichenbacher-style attack when an attacker is able to provide the CMS or S/MIME messages and observe the error code and/or decryption output. Impact summary: The Bleichenbacher-style attack allows an attacker to use the victim's vulnerable application as a way to decrypt or sign messages with the victim's private RSA ke | Low 3.7 | 9 Jun 2026 |
| CVE-2026-42769 | Issue Summary: An error in the callback used to verify the certificate provided in a Root CA key update Certificate Management Protocol (CMP) message response rendered the certificate validation ineffectual, which could lead to escalation of credentials from the Registration Authority (RA) level to the root Certification Authority (root CA) level. Impact Summary: The Registration Autority could re | Medium 5.3 | 9 Jun 2026 |
| CVE-2026-34180 | Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms. Impact summary: The heap buffer over-read may crash the application (Denial of Service) or to load into the decoded ASN.1 object contents of memory beyond the end of the input buffer. More typical | High 7.5 | 9 Jun 2026 |
| CVE-2026-34181 | Issue Summary: The PKCS#12 file processing fails to perform sufficient input validation for files that use Password-Based Message Authentication Code 1 (PBMAC1) integrity mechanism allowing a certificate and private key forgery. Impact Summary: An attacker impersonating a user can cause a service reading PKCS#12 files to accept forged certificates and private keys with a 1 in 256 probability. If a | High 7.4 | 9 Jun 2026 |
| CVE-2026-34182 | Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises. Impact Summary: Attackers making use of these vulnerabilities may achieve key-equivalent functionality for a given CMS recipient and/or bypass integrity validation for a given messa | Critical 9.1 | 9 Jun 2026 |
| CVE-2026-34183 | Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames. Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termination of the application acting as a QUIC client or server and a Denial of Service. A remote peer may exhaust heap memory by flooding the loc | High 7.5 | 9 Jun 2026 |
| CVE-2026-35188 | Issue summary: A malicious server can exploit TLS OCSP stapling by delivering a crafted response through the status_request extension, triggering a double-free in the client's certificate verification path. Impact summary: Successful exploitation allows an attacker to corrupt heap memory via a double-free, potentially leading to a Denial of Service or possibly an attacker controlled code execution | Medium 5.0 | 9 Jun 2026 |
| CVE-2026-31789 | Issue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit platforms. Impact summary: A heap buffer overflow may lead to a crash or possibly an attacker controlled code execution or other undefined behavior. If an attacker can supply a crafted X.509 certificate with an excessively large OCTET STRING value in extensions such a | Critical 9.8 | 7 Apr 2026 |
| CVE-2026-31790 | Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous execution of the application process which leads to sensitive data leakage to an attacker. RSA_public_encrypt() returns the number of bytes wri | High 7.5 | 7 Apr 2026 |
| CVE-2026-28386 | Issue summary: Applications using AES-CFB128 encryption or decryption on systems with AVX-512 and VAES support can trigger an out-of-bounds read of up to 15 bytes when processing partial cipher blocks. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application if the input buffer ends at a memory page boundary and the following page is unmapped. | High 7.5 | 7 Apr 2026 |
| CVE-2026-28387 | Issue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, the issue onl | High 8.1 | 7 Apr 2026 |
| CVE-2026-28388 | Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the del | High 7.5 | 7 Apr 2026 |
| CVE-2026-28389 | Issue summary: During processing of a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is processed, the optional p | High 7.5 | 7 Apr 2026 |
| CVE-2026-28390 | Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryp | High 7.5 | 7 Apr 2026 |
| CVE-2026-2673 | Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword. Impact summary: A less preferred key exchange may be used even when a more preferred group is supported by both client and server, if the group was not included among the client's initial predicated k | Medium 6.5 | 13 Mar 2026 |
| CVE-2026-22796 | Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS#7 data where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing malformed PKCS#7 data. Impact summary: An application performing signature verification of PKCS#7 data or calling directly the PKCS7_digest_from_attribut | Medium 5.3 | 27 Jan 2026 |
| CVE-2026-22795 | Issue summary: An invalid or NULL pointer dereference can happen in an application processing a malformed PKCS#12 file. Impact summary: An application processing a malformed PKCS#12 file can be caused to dereference an invalid or NULL pointer on memory read, resulting in a Denial of Service. A type confusion vulnerability exists in PKCS#12 parsing code where an ASN1_TYPE union member is accessed w | Medium 5.5 | 27 Jan 2026 |
| CVE-2025-69419 | Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write before the allocated buffer. Impact summary: The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service. The OPENSSL_uni2utf8() function | High 7.4 | 27 Jan 2026 |
| CVE-2025-69420 | Issue summary: A type confusion vulnerability exists in the TimeStamp Response verification code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing a malformed TimeStamp Response file. Impact summary: An application calling TS_RESP_verify_response() with a malformed TimeStamp Response can be caused to derefe | High 7.5 | 27 Jan 2026 |
| CVE-2025-69421 | Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function. Impact summary: A NULL pointer dereference can trigger a crash which leads to Denial of Service for an application processing PKCS#12 files. The PKCS12_item_decrypt_d2i_ex() function does not check whether the oct parameter is NULL before dereferencing it. When ca | High 7.5 | 27 Jan 2026 |
| CVE-2025-69418 | Issue summary: When using the low-level OCB API directly with AES-NI or<br>other hardware-accelerated code paths, inputs whose length is not a multiple<br>of 16 bytes can leave the final partial block unencrypted and unauthenticated.<br><br>Impact summary: The trailing 1-15 bytes of a message may be exposed in<br>cleartext on encryption and are not covered by the authentication tag,<br>allowing an | Medium 4.0 | 27 Jan 2026 |
| CVE-2025-66199 | Issue summary: A TLS 1.3 connection using certificate compression can be forced to allocate a large buffer before decompression without checking against the configured certificate size limit. Impact summary: An attacker can cause per-connection memory allocations of up to approximately 22 MiB and extra CPU work, potentially leading to service degradation or resource exhaustion (Denial of Service). | Medium 5.9 | 27 Jan 2026 |
| CVE-2025-68160 | Issue summary: Writing large, newline-free data into a BIO chain using the line-buffering filter where the next BIO performs short writes can trigger a heap-based out-of-bounds write. Impact summary: This out-of-bounds write can cause memory corruption which typically results in a crash, leading to Denial of Service for an application. The line-buffering BIO filter (BIO_f_linebuffer) is not used b | Medium 4.7 | 27 Jan 2026 |
| CVE-2025-15469 | Issue summary: The 'openssl dgst' command-line tool silently truncates input data to 16MB when using one-shot signing algorithms and reports success instead of an error. Impact summary: A user signing or verifying files larger than 16MB with one-shot algorithms (such as Ed25519, Ed448, or ML-DSA) may believe the entire file is authenticated while trailing data beyond 16MB remains unauthenticated. | Medium 5.5 | 27 Jan 2026 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Separately, for a merged upstream patch : up to $15,000 Google Patch Rewards pays for a patch you get accepted upstream and that stays merged, without reverts, for one month. It does not pay for the report. Memory-safety hardening can carry a 2× or 3× multiplier. Sanctions and territory exclusions apply, and it is rate-limited to three submissions a month. CVE history 38 Last 12 months 294 Lifetime Memory safety 43 % Auth bypass 19 % Parsing/validation 19 % Denial of service 14 % Latest advisories Loading the feed Overview OpenSSL is the TLS and cryptography library underneath most of the internet: web servers, load balancers, language runtimes, package managers, embedded firmware and the majority of Linux userland all link against it. Everything above it assumes that a handshake is private and that a certificate chain either verifies or does not. Heartbleed is the reference point for what a bug here costs. The project pays nothing for a vulnerability report, and reports go to its security team through a private address, so sorona.xyz pays you directly on qualified, reproduced findings. In scope Reports go privately to the OpenSSL security team at [email protected] and cover OpenSSL's own code; a defect that lives in a bundled dependency goes to that project instead The whole of libcrypto and libssl as reachable from untrusted network peers, including heap and stack overflows, use-after-free, and out-of-bounds reads or writes The TLS and DTLS handshake and record layers, covering key exchange, session resumption, renegotiation, and fragment reassembly X.509 certificate parsing and chain building, including path validation, name-constraint enforcement, and CRL and OCSP handling, and anything that lets an attacker bypass verification ASN.1 and DER decoding of attacker-supplied certificates, keys, and structures Parsing of PKCS containers from untrusted data (PKCS#7, PKCS#8, PKCS#12) and PEM handling Cryptographic implementation flaws with demonstrated impact, including timing and side-channel leakage in supported operations The provider and ENGINE interfaces where untrusted configuration or input crosses into library state Out of scope Attacks that assume the attacker already controls trusted inputs such as private keys or the trusted CA store, which sit inside the trust boundary Application-side API misuse: ignoring return values, calling functions out of the documented order, or passing invalid parameters Defects that actually live in a bundled or linked dependency rather than in OpenSSL itself Objections to default cipher, protocol, or algorithm selection, which are configuration and policy matters Issues confined to the command-line utilities rather than the libraries Deprecated and legacy interfaces the project has already announced as unsupported Most-valued findings Remote, unauthenticated memory corruption in libssl reachable during the handshake, before any authentication completes. That is the Heartbleed shape and the highest-value class here Certificate or chain validation bypass that makes a bad certificate verify, since it breaks the guarantee every caller depends on Memory-safety flaws in ASN.1 and X.509 parsing driven purely by attacker-supplied bytes Practical side channels that recover key material from a supported operation, as opposed to a timing difference with no demonstrated recovery Client-side memory corruption triggered by a malicious server, which turns every outbound TLS connection into an attack surface Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Send a detailed, reproducible report; if we can't reproduce it, it isn't eligible One vulnerability per report unless a chain is needed to show the real impact Give the OpenSSL security team room to ship a fix before any public writeup Findings that live in a bundled dependency belong upstream with that project rather than here If you also want the Google patch money, land the fix upstream yourself and keep it merged for a month; that is a separate pathway with its own rules Disclosure Coordinated with the OpenSSL security team through [email protected] . The project batches fixes into scheduled releases and publishes its own advisory with researcher credit; hold the detail until that advisory is out. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability