OpenVPN

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Separately, for a merged upstream patch : up to $15,000 Google Patch Rewards pays on the Tier 1 row for a patch you get accepted upstream and that stays merged, without reverts, for one month. It does not pay for the report. Memory-safety work can carry a 2× or 3× multiplier. The patch must be under twelve months old, it is rate-limited to three submissions a person a month, one-liner fixes for non-exploitable crashes are excluded, and sanctions and territory exclusions apply. CVE history 5 Last 12 months 34 Lifetime Memory safety 35 % Denial of service 30 % Auth bypass 15 % Parsing/validation 15 % Latest advisories Loading the feed Overview OpenVPN has been the default enterprise remote-access VPN for two decades and it is still the fallback protocol on commercial VPN services, consumer router firmware such as OpenWrt, pfSense and MikroTik, NAS appliances and a large installed base of corporate concentrators. WireGuard is displacing it and has nowhere near replaced it, and the estates where it survives as the compatibility protocol of last resort are the ones that patch slowest. The daemon's whole job is to sit on a UDP/1194 or TCP/443 listener facing the public internet, so a pre-authentication defect in the TLS control channel is reachable from anywhere. The community project pays nothing for a report, so sorona.xyz pays you directly on a qualified, reproduced finding. In scope Reports go to the OpenVPN security address and cover the open-source community edition, the tree published at openvpn.net/community. Access Server and CloudConnexa are a separate proprietary product line The TLS control channel in full, including the tls-crypt and tls-crypt-v2 wrapping, historically the richest pre-authentication surface in the daemon The data channel in full: OCC and PUSH_REPLY option parsing, packet-ID and replay handling, and --fragment and --mssfix reassembly Certificate, key and configuration handling, covering the option parser and everything the daemon reads from a config file, a pushed option or a peer certificate The Data Channel Offload (DCO) kernel modules on Linux and Windows, and the netlink and ioctl boundary they expose to userspace The management interface and the plugin API, including openvpn-plugin-auth-pam and down-root Server-mode session handling as a whole, covering peer-ID and multi-instance state, where one hostile client can reach into another client's session The client side of the protocol, where a hostile or compromised server drives the daemon with attacker-chosen options and responses Out of scope OpenVPN Access Server and CloudConnexa, which are proprietary and sit outside the Patch Rewards scope row Operator configuration mistakes such as a missing tls-auth or a deliberately weak cipher choice easy-rsa , which is a separate repository with no funding pathway of its own Third-party GUI wrappers such as Tunnelblick and OpenVPN Connect, and distribution packaging One-line fixes for non-exploitable crashes, which the Patch Rewards rules exclude, including crashes that come from resource exhaustion Most-valued findings Pre-authentication memory corruption in the TLS control channel or the tls-crypt wrapping, reachable on the public listener before any credential is checked. That is the top class here at 35% and the finding the Tier 1 ceiling exists for An authentication bypass that lets a client establish or resume a session it has no credential for, which turns the concentrator into an open door onto the internal network Cross-session state confusion in server mode, where one connected client reads or steers another client's traffic through peer-ID or multi-instance handling Memory-safety or privilege defects in the DCO kernel modules, where the same bug class escalates from daemon compromise to kernel compromise A remotely triggerable crash or hang in the control channel with a real algorithmic cause, on a daemon whose availability is the whole point of the deployment Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Send a detailed, reproducible report to the OpenVPN security address; if it cannot be reproduced it is not eligible Only the open-source community edition is in scope: Access Server and CloudConnexa are proprietary and appear nowhere in the Patch Rewards scope file Give the maintainers room to ship a fix and an advisory before any public writeup The Google patch money is a separate pathway: you land the fix upstream yourself and keep it merged, without reverts, for one month On that pathway the patch must be under twelve months old and you may submit at most three a month; one-liner fixes for non-exploitable crashes, including resource-exhaustion crashes, are not rewarded Google cannot pay anyone on a sanctions list, in a sanctioned territory, or located in Russia or Belarus Disclosure Coordinated with the OpenVPN community maintainers through [email protected] . They fix in a point release and publish their own advisory with researcher credit, so hold the detail until that release ships. Nothing in the Patch Rewards rules restricts who may help you prepare or route the report. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability