Protocol Buffers

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Product vulnerability (Tier OT0; supply-chain compromise is a separate category) │ $500 - $7,500 │ $625 - $8,500 Other security issue (Tier OT0 flat award) │ $1,000 │ $1,250 Submit a vulnerability CVE history 2 Last 12 months 10 Lifetime Denial of service 40 % Parsing/validation 30 % Memory safety 20 % Info disclosure 5 % Latest advisories Loading the feed Overview Protocol Buffers is the wire format for gRPC, and therefore for the internal RPC layer of a very large share of cloud-native software: Kubernetes, etcd, Envoy, Istio, containerd, CockroachDB, Vitess and the entire Google Cloud API surface all speak it, and it is a build-time and runtime dependency of Android, TensorFlow's SavedModel format and OpenTelemetry's OTLP. A parser bug reachable from untrusted bytes lands simultaneously in server infrastructure, on mobile devices and inside ML pipelines: CVE-2024-7254, unbounded recursion in the Java parser, is the recent reference point. Google pays for it through the Bug Hunters open-source VRP at Tier OT0, where a product vulnerability in the project's own code runs from $500 to $7,500 at a panel's discretion. sorona.xyz adds 1.25× on top of whatever Google awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Google's open-source VRP takes security issues in the latest versions of the code held in the repositories it lists, and protocolbuffers/protobuf is named explicitly in the published tier file at TIER_OT0: a product vulnerability anywhere in the monorepo is accepted, at $500 to $7,500 Every runtime the monorepo ships: C++, Java, Kotlin, Python, Go, C#, Ruby, PHP and Objective-C, along with the upb core the newer ones are built on The protoc compiler front to back: .proto lexing and parsing, option and edition handling, the descriptor pool it builds, and the code it generates for each target language Wire-format parsing and serialisation: varint decoding, length-delimited fields, legacy groups, packed repeated fields, unknown-field retention and the recursion and size limits The text-format and JSON mapping parsers and printers, which accept human-authored and web-sourced input directly descriptor.proto , the reflection API, dynamic message construction, and the well-known types including Any , Struct , Timestamp and Duration The arena allocator, lazy and unverified-lazy field handling, and the message copy, merge and swap paths Repository configuration and the release workflows that publish to Maven, PyPI, npm, NuGet, RubyGems and the Go module proxy, which Google prices under its separate supply-chain category Out of scope Downstream misuse of protobuf APIs that are documented to require already-sanitised input Resource-exhaustion crashes with negligible security impact under the project's own threat model Third-party protobuf reimplementations such as protobuf.js or gogo/protobuf, which are not in the tier file Typosquatting and dependency confusion, unless it actually compromises the distributed build artifacts Memory-corruption reports that arrive without exact OSS-Fuzz reproduction steps against an existing fuzz target, or a merged upstream patch Other repositories in the protocolbuffers org, which the tier file does not list and which pay nothing for a product vulnerability after the April 2026 rules update Defects that only reproduce on a release the project no longer ships, since the program covers the latest versions Reports filed by anyone other than the finder: Google wants the submission through bughunters.google.com under the researcher's own identity, and it does not pay Google or Google Partner employees Rewards to researchers on a sanctions list, in a sanctioned territory, or located in Russia or Belarus, which Google states it cannot issue Most-valued findings A parser flaw in the C++ runtime reachable purely from attacker-supplied bytes on an RPC boundary, which is the highest-impact route into the $7,500 band because it lands in every gRPC server that deserialises a request before authenticating it Unbounded recursion or allocation in a managed-language parser that a small message can trigger, the CVE-2024-7254 and CVE-2021-22569 shape and the reason denial of service is 40% of this project's history Wire-format confusion where two runtimes disagree about the same bytes, since a cross-language parsing mismatch turns protobuf into a request-smuggling primitive between services Memory-safety defects in protoc or the C++ runtime submitted with OSS-Fuzz reproduction steps, which is the only form of that report the program will price Text-format or JSON-mapping parser bugs, because those surfaces routinely receive input straight from a web request rather than from a trusted peer Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. The repo is rated TIER_OT0, where product vulnerabilities cap at $7,500; the $31,337 ceiling requires a supply-chain compromise of the repository or release pipeline, which is a different reward category Memory-corruption reports need exact OSS-Fuzz reproduction steps or a merged patch: a crash you cannot hand over as a reproducer is not enough The award is set by a discretionary panel, so the band is a range rather than a fixed table and a report that spells out real impact is what moves you up it Google cannot pay researchers on sanctions lists or in sanctioned territories, and does not pay into Russia or Belarus Take the flaw to Google before anyone else: the VRP treats private disclosure to a third party for purposes other than fixing the bug as grounds to refuse the reward Disclosure Coordinated through Google Bug Hunters, with the fix landing in the protobuf repository and an advisory published across the affected language packages. Because the program's own rules can be read as barring a third-party hand-off before the fix ships, file with Google directly and hold the detail until the release is out. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability