RE2

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Product vulnerability (Tier OT1; supply-chain compromise is a separate category) │ $101 - $3,133.70 │ $126 - $3,916.70 Other security issue (Tier OT1 flat award) │ $500 │ $625 Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime Memory safety 45 % Denial of service 25 % Parsing/validation 25 % Info disclosure 4 % Latest advisories Loading the feed Overview RE2 is the regex engine you reach for when a system has to run untrusted patterns safely, so it is deployed exactly where regexes are attacker-controlled: Chromium's content filtering, BigQuery and Cloud Logging query syntax, ClickHouse, Envoy's route matching, which puts it in the request path of service meshes, nginx modules, gRPC, and the Python google-re2 bindings used across data pipelines. Its whole value proposition is a security guarantee, that a regex cannot blow up superlinearly, which means a defect here breaks a property downstream systems explicitly relied on when they decided to accept untrusted patterns at all. It also has a clean record: NVD, OSV and GitHub advisories all return nothing for it, which for a fifteen-year-old C++ parser is genuinely unusual and reflects heavy continuous fuzzing. Google prices it at Tier OT1 on the Bug Hunters open-source VRP, $101 to $3,133.70 for a product vulnerability at a panel's discretion. sorona.xyz adds 1.25× on top of whatever Google awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Google's open-source VRP takes security issues in the latest versions of the code held in the repositories it lists, and google/re2 is named in the published tier file at TIER_OT1: a product vulnerability anywhere in the engine's own code is accepted, at $101 to $3,133.70 The pattern parser in parse.cc and everything it feeds: simplification, rewriting, and the walkers that turn a parsed regexp into something executable The compiler and the Prog representation it emits, including the onepass and bitstate analyses and the instruction encoding All four execution engines, NFA, DFA, bitstate and onepass, the DFA state cache they build and share, the max_mem budget, and the fallback behaviour once that budget is exhausted The public C++ API: RE2 construction and options, FullMatch , PartialMatch , Consume , Replace and GlobalReplace , submatch extraction, and the typed argument parsers RE2::Set , FilteredRE2 and the prefilter and atom machinery used to run many patterns against one input Character-class, Unicode-property and case-folding tables, and the UTF-8 and Latin-1 decoding performed inside matching The C++, Python ( google-re2 ) and other binding surfaces built out of this repository, plus its release pipeline, which Google prices under its separate supply-chain category Out of scope Catastrophic-backtracking reports, since RE2's entire design guarantee is linear-time matching and the absence of backtracking PCRE, RE2J and other regex engines, including ones that advertise RE2-compatible syntax Applications that choose to compile attacker-supplied patterns without setting a max_mem limit Syntax incompatibilities with PCRE that carry no security impact Memory-corruption reports submitted without exact OSS-Fuzz reproduction steps against an existing fuzz target, or a merged upstream patch Repositories in Google's GitHub orgs that the tier file does not list, which pay nothing for a product vulnerability after the April 2026 rules update Defects that only reproduce on a release the project no longer ships, since the program covers the latest versions Reports filed by anyone other than the finder: Google wants the submission through bughunters.google.com under the researcher's own identity, and it does not pay Google or Google Partner employees Rewards to researchers on a sanctions list, in a sanctioned territory, or located in Russia or Belarus, which Google states it cannot issue Most-valued findings Memory corruption in the parser or one of the execution engines reachable from an attacker-supplied pattern, with OSS-Fuzz reproduction steps attached: memory safety is 45% of the expected profile and this is the class that reaches the top of the $3,133.70 band Any input that makes matching take superlinear time, because that is not a performance complaint here, it is a direct break of the guarantee every embedder relied on when it accepted untrusted patterns A max_mem accounting flaw that lets a pattern exceed its declared budget or drives the DFA fallback into pathological behaviour Parser or simplification-pass bugs where a crafted pattern compiles to a program that does not match what the syntax says, which turns RE2 into a filter-bypass primitive in Envoy route matching or content filtering Memory disclosure from RE2::Set or the prefilter machinery, where submatch or capture-group state from one match survives into another Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. The repo is rated TIER_OT1, one band below the OT0 libraries, so product vulnerabilities cap at $3,133.70 rather than $7,500 The $13,337 figure quoted for OT1 is the supply-chain-compromise category, covering the repository or release pipeline rather than a code vulnerability in the repo Catastrophic-backtracking reports are out of scope by design: RE2 exists precisely because it does not backtrack, so a claimed ReDoS is either not RE2's behaviour or is the finding itself Memory-corruption reports need OSS-Fuzz reproduction steps or a merged patch: this is heavily fuzzed C++ and a crash without a reproducer will not be priced Take the flaw to Google before anyone else: the VRP treats private disclosure to a third party for purposes other than fixing the bug as grounds to refuse the reward Disclosure Coordinated through Google Bug Hunters. The repository has never published a security advisory, so expect the fix to land as an ordinary commit and a release rather than as a numbered event; hold your writeup until it has shipped and downstream embedders have had time to pick it up. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability