PowerDNS

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Separately, for a merged upstream patch : up to $5,000 Google Patch Rewards pays on the Tier 2 OSS-Fuzz row for a patch you get accepted upstream and that stays merged, without reverts, for one month. It does not pay for the report. Memory-safety work can carry a 2× or 3× multiplier. This pathway is Google's rather than Open-Xchange's, and carries none of the VDP's gag or IP-assignment terms; sanctions and territory exclusions apply. CVE history 55 Last 12 months 126 Lifetime Denial of service 45 % Parsing/validation 20 % Memory safety 20 % Info disclosure 10 % Latest advisories Loading the feed Overview PowerDNS ships three products out of one repository: the Authoritative Server behind a large share of European ISPs and hosting providers, the Recursor serving subscriber bases at telco scale, and dnsdist, the DNS-layer load balancer and DoH/DoT front end that sits on the internet edge in front of other operators' resolvers. A cache-poisoning defect in the Recursor reaches a whole subscriber base at once, because every household behind it is served the same forged answer. The project pays nothing for a vulnerability report. Open-Xchange, its owner, runs a private YesWeHack program whose ceiling is unpublished and whose terms carry an indefinite third-party gag, so sorona.xyz pays you directly on a qualified, reproduced finding. In scope Reports go through the channel named in the repository's SECURITY.md and cover the upstream GPL-2.0 monorepo: the Authoritative Server, the Recursor and dnsdist. Open-Xchange's hosted and commercial platform products sit outside it The Recursor in full: its cache and resolution logic, cache poisoning, the record-count and Rebirthday class, and the deferred-resolution machinery dnsdist in full, the most network-exposed component, covering its Lua policy engine, DoH, DoT and DoQ termination, and dynamic-block logic The Authoritative Server in full, including every backend it ships, and particularly the SQL backends where zone data crosses a query boundary DNSSEC signing and the pdnsutil tooling that manages keys and zone state The web API and the dnsdist console, which are administrative but frequently exposed further than their operators intend Packet and record parsing across all three products, where a crafted query or response is decoded on a daemon facing the open internet Out of scope Open-Xchange's hosted and commercial platform products, which are not the upstream monorepo Backend database misconfiguration rather than a defect in PowerDNS itself Query-volume denial of service with no algorithmic defect behind it Zone-content problems that are the operator's own data rather than a parser or resolver defect One-line fixes for non-exploitable crashes, which the Patch Rewards rules exclude Most-valued findings Recursor cache poisoning that puts an attacker-chosen answer in front of a whole subscriber base. That outcome makes a resolver bug an ISP-wide event rather than a single-host one Remotely triggerable denial of service in the Recursor or dnsdist with a real algorithmic cause: 45% of this project's history is DoS, and dnsdist is deployed precisely to be the component that survives abusive traffic Memory corruption in packet or record parsing reachable from a single crafted query or response, on daemons that face the open internet by design Flaws in dnsdist's Lua policy engine or its DoH and DoQ termination, which sits in front of other operators' resolvers and terminates their transport Cross-zone or cross-tenant information disclosure through an authoritative SQL backend, where one query reaches zone data it should never see Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. If you take the finding to Open-Xchange's private VDP, file it yourself and read the terms first: they impose an indefinite third-party gag and assign the intellectual property in what you submit Send a detailed, reproducible report through the channel named in the repository's SECURITY.md; if it cannot be reproduced it is not eligible Say which of the three products you hit: Authoritative, Recursor or dnsdist. They have separate release trains and separate advisories The Google patch money is a separate pathway, and its rules carry none of the Open-Xchange restrictions: you land the fix upstream yourself and keep it merged, without reverts, for one month Only the upstream GPL-2.0 monorepo is in scope; Open-Xchange's hosted and commercial platform products are not Google cannot pay anyone on a sanctions list, in a sanctioned territory, or located in Russia or Belarus Disclosure Coordinated with the PowerDNS engineering team, which runs a fast, public advisory process and credits researchers. Treat the two pathways separately: Open-Xchange's private VDP gags third-party involvement indefinitely, so file that one yourself and directly, while the Patch Rewards patch route carries no such restriction. sorona.xyz holds your finding until the fix has shipped. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability