quiche

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (Tier 2 open-source row, not the $10,000 production tier) │ $3,500 │ $4,375 High │ $1,500 │ $1,875 Medium │ $750 │ $938 Low │ $250 │ $313 Submit a vulnerability CVE history 2 Last 12 months 5 Lifetime Parsing/validation 40 % Denial of service 30 % Memory safety 15 % Info disclosure 10 % Latest advisories Loading the feed Overview quiche is the QUIC and HTTP/3 implementation Cloudflare runs at its own edge, so it terminates HTTP/3 for a very large share of the sites that speak HTTP/3 at all. It is also the QUIC library behind the nginx http_v3_module builds Cloudflare contributed, ships as both a Rust crate and a C library, and is embedded in Android's cronet-adjacent stacks and a range of commercial CDN and mobile-networking products. Its CVE record runs at a steady one to two a year over four years, all in the transport layer, which is exactly where a parsing mistake turns into a remotely reachable memory or availability bug across every embedder at once. Cloudflare pays it on the Tier 2 open-source row, $250 at Low up to $3,500 for a Critical, and sorona.xyz adds 1.25x on top of whatever Cloudflare awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times 10 business days First response 10 business days after first response Triage 10 business days after triage Bounty In scope Cloudflare declares its open-source scope org-wide: any Cloudflare-published project under github.com/cloudflare is bounty-eligible on the Tier 2 open-source row, capped at $3,500 for a Critical. cloudflare/quiche is covered by both bountied org-wide assets and is absent from the descoped list, so the library is in scope as a whole. Mind the name collision: the covered repository is Cloudflare's Rust stack, and Google's separate C++ project of the same name has no pathway here The QUIC transport state machine in full: version negotiation, connection establishment, connection IDs, retry and token validation, path validation, migration and connection close Packet protection and header protection, packet number decoding, frame parsing, and the varint decoders every packet passes through before anything else is trusted Stream state, flow control, prioritisation and the unreliable datagram extension Loss recovery, the congestion controllers, and the anti-amplification limits that keep the stack from being used as a reflector The BoringSSL TLS 1.3 handshake integration, session resumption, and 0-RTT and early-data replay handling HTTP/3 and QPACK: frame parsing, header encoding and decoding, the dynamic table shared across a connection, and the extended CONNECT path The C FFI layer exposed through quiche.h , which nginx and other embedders link against directly, together with the nginx HTTP/3 patch carried in the repository The supporting crates published from the same repository, including the octets byte parser and the qlog implementation Out of scope Interoperability quirks with other QUIC stacks that carry no security consequence Denial of service whose cost is merely linear in the size of the input Findings confined to the apps/ example binaries with no impact at the library level BoringSSL vulnerabilities proper, which belong to Google's own reporting pathway rather than Cloudflare's Static-analysis-only reports submitted without a runnable reproduction Reports against github.com/google/quiche , a separate C++ QUIC stack that shares the name and has a different owner Severity cap to plan around: the Tier 2 open-source row tops out at $3,500 for a Critical, since Cloudflare's $10,000 row is bound to production infrastructure rather than the GitHub org Most-valued findings Memory corruption reachable from a single unauthenticated packet through the frame, varint or packet-number decoders, the top-severity shape for this library QPACK or HTTP/3 header handling flaws that corrupt shared dynamic-table state or let one request's headers influence another's Transport state machine confusion around retry tokens, connection IDs, path validation or migration that lets a third party take over or redirect a connection Amplification or asymmetric-cost denial of service that is superlinear in attacker effort and survives the stack's own anti-amplification limits 0-RTT replay or handshake integration flaws that let early data be accepted twice or under the wrong identity Anything in the C FFI surface that an embedder such as nginx would hit with ordinary use rather than with a contrived call sequence Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. A working proof of concept is mandatory, and local reproduction against your own build is what the program expects to see Report against github.com/cloudflare/quiche , not github.com/google/quiche , which is a different QUIC stack with a different owner and no Cloudflare pathway Static analysis with no runnable reproduction is closed Informational however severe the code reads Show impact in a supported or realistic deployment, not just isolated source-level behaviour, which is the policy's standard for open-source reports Name the crate version or commit and the peer role you attacked from, since transport bugs read very differently client-side and server-side Program stats 376 Reports resolved $568k Bounties paid 77% Response efficiency Disclosure Coordinated with Cloudflare on a bounded clock: nothing may be published for 90 days from submission without prior written approval. quiche findings normally end in a CVE and a crates.io advisory, with CVE-2026-11941 landing inside the last twelve months, so the pipeline that turns a report into a public advisory is demonstrably live and sorona.xyz holds the finding until it completes. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability