Proxygen

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Minimum award, where Meta pays a bounty at all │ $500 │ $625 Maximum: discretionary, no published ceiling for open source │ not published │ not published Submit a vulnerability CVE history 2 Last 12 months 12 Lifetime Denial of service 40 % Memory safety 30 % Parsing/validation 20 % Info disclosure 5 % Latest advisories Loading the feed Overview Proxygen is the HTTP/1.1, HTTP/2 and HTTP/3 library behind Meta's edge load balancers, so it terminates a very large share of Meta's inbound traffic. Third-party adoption is modest next to nginx or Envoy, but that undersells it: Proxygen is one of a small number of independent production HTTP/3 implementations, which means a parser or state-machine defect found here frequently generalises across the ecosystem: Proxygen carried CVE-2023-44487, the HTTP/2 Rapid Reset denial of service that hit every HTTP/2 implementation in 2023. It is also the most active CVE surface of any repository in this program, twelve lifetime with two inside the last twelve months, which is what a directly network-facing HTTP stack looks like. Meta pays cash for a report on its own bug bounty: the published minimum is $500, Meta determines severity, and no payout guideline covers open source, so there is no maximum stated in advance. sorona.xyz adds 1.25× on top of whatever Meta awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Meta declares its open-source scope as GitHub organisation prefixes. The scope table's Open source row lists https://github.com/facebook/ and https://github.com/facebookincubator/ as eligible code repos, and facebook/proxygen sits under the first, so the repository is in scope in full. The row sets no severity cap and Meta publishes no payout guideline covering open source The codecs the library ships, on both the request and the response side: HTTP/1.1, HTTP/2 with HPACK, and HTTP/3 with QPACK The session and transaction layer, covering the stream state machines, flow control, concurrency limits, priorities and connection reuse The server side: the HTTP server and its acceptors, connection handling, TLS termination through fizz, and the filter chain a request handler sits behind The client side: the HTTP client, connection pooling and upstream session handling The proxy and forwarding paths, header rewriting, and the boundary Proxygen occupies between an upstream and a downstream peer Upgrade paths: WebSocket, CONNECT and extended CONNECT, along with the transport binding onto QUIC streams for HTTP/3 Content-encoding handling and the compression helpers, plus the sample servers and utilities in the repository Out of scope Repositories outside those two prefixes. The same scope row names https://github.com/facebookarchive/ as ineligible, and neither facebookresearch/ nor the react/ org that React and React Native moved into appears on the eligible list Extremely low-risk issues, which Meta states may not qualify for a bounty at all Findings with no demonstrated impact on Meta users or systems, since that is what Meta scores a report on Duplicates. Meta pays the first reporter only Awards that sanctions screening blocks: Meta verifies every bounty is permitted under US trade sanctions and economic restrictions Defects that actually live in Folly, fizz or mvfst rather than in Proxygen's own code. Each is a separate repository with its own entry under the same program Specification complaints: behaviour that is unpleasant and is also what the relevant HTTP RFC mandates Load-generation results where the attack costs the attacker as much as the defender, which is volume rather than a vulnerability Most-valued findings Remote memory corruption in an HTTP/2 or HTTP/3 codec reachable pre-authentication from frames a client chooses, the shortest path to the code-execution rung Meta reserves the top of its discretionary band for An asymmetric denial of service where one cheap client forces disproportionate work on the server, the Rapid Reset shape Proxygen already carried once as CVE-2023-44487 Request smuggling or response desync between Proxygen and a peer, which turns an edge proxy into a cross-request data leak QPACK or HPACK decoder flaws, since header-compression state is attacker-controlled and shared across every stream on a connection A protocol-level defect in the HTTP/3 implementation that reproduces against other stacks, since an independent implementation is worth the most to the ecosystem when its bugs generalise This is the most active CVE surface in the program, twelve lifetime with two inside the last twelve months, CVE-2025-55181 among them. The codecs are worth the first week ahead of anything else in Meta's open-source set Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. File through the report form at bugbounty.meta.com; Meta asks that you not contact its staff directly or through any other channel about a report Awards are entirely at Meta's discretion and Meta determines severity: no published payout guideline covers open source Duplicates pay only the first reporter Meta scores a report on impact to Meta users and systems, so show the behaviour against a server configuration Meta would plausibly run rather than one you had to weaken Only repositories under https://github.com/facebook/ and https://github.com/facebookincubator/ are eligible; facebook/proxygen qualifies under the first Awards are subject to sanctions screening; Meta verifies that every bounty is permitted under US trade sanctions and economic restrictions Disclosure Coordinated with Meta, on Meta's clock. Its terms ask for reasonable time to investigate and mitigate before you disclose publicly or share the report with others, Meta alone judges what is reasonable, and Meta reserves the right to publish reports and their updates itself. Protocol-level findings that generalise across implementations usually also want a multi-vendor coordination path, but Meta's window comes first. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability