- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 13
- Public CVEs
- 40
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 7 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Response
-
Within 7 days
The policy commits to a response within one week, so a silence longer than that is worth chasing rather than assuming
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
13 assets you may test, 6 excluded.
Web 1
- https://www.riot-os.org
Products and areas 12
- CoAP handling in nanocoap and gcoap, including option parsing, block-wise transfer and the observe mechanism
- Filesystem support, storage drivers and the flash abstraction underneath them
- LoRaWAN and the IEEE 802.15.4 radio drivers, along with the link-layer code that parses frames straight off the air
- Peripheral and sensor drivers in the tree, which parse data from hardware an attacker may control
- SUIT firmware update handling: the CoAP trigger path, manifest parsing, signature verification and the flash write that follows
- The Bluetooth Low Energy integration and the other wireless transports in the tree
- The cryptographic modules and the PSA Crypto implementation, together with the DTLS and TLS integrations
- The DHCPv6 client and the other network configuration clients that act on unauthenticated responses from the network
- The GNRC network stack end to end, covering IPv6, 6LoWPAN fragmentation and reassembly, UDP, TCP and the neighbour-discovery layer
- The kernel: the scheduler, threading, inter-process communication, mutexes and the memory allocators
- The policy asks for any security issue by private mail to the project security address, publishes a GPG key for it and sets out declassification rules. It draws no boundary narrower than the RIOT tree itself
- The USB device stack and the shell reachable over serial, which a great many deployments leave enabled
Out of scope (6)
- Application code written against RIOT that misuses an API in a way the documentation warns against
- Board configurations that deliberately leave a debug shell or an unauthenticated service enabled
- Denial of service that amounts to jamming the radio or flooding the link
- Downstream products and vendor forks built on RIOT rather than the upstream tree
- Physical attacks on a node an attacker already holds, including reading flash over a debug port
- Third-party packages pulled in through the package system, unless RIOT's own use of them is what makes the defect reachable
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
Report to the address on the policy page , the address the SECURITY.md names, or through GitHub private vulnerability reporting on RIOT-OS/RIOT
-
Encrypt to the project GPG key, fingerprint 44C6AE441172F88D3423E81F5F7964D0F4239033, published at riot-os.org/assets/keys/security.asc
-
Name the board and the network stack you reproduced on. GNRC and the alternative stacks take different code paths and a defect may only be reachable through one of them
-
Say which transport carried the input: an attack reachable over the radio and one needing a wired link are different findings on this class of hardware
-
Hold detail until that two-week window has run
Not accepted
-
Application code written against RIOT that misuses an API in a way the documentation warns against
-
Board configurations that deliberately leave a debug shell or an unauthenticated service enabled
-
Third-party packages pulled in through the package system, unless RIOT's own use of them is what makes the defect reachable
-
Physical attacks on a node an attacker already holds, including reading flash over a debug port
-
Denial of service that amounts to jamming the radio or flooding the link
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-27703 | RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. In 2026.01 and earlier, the default handler for the well_known_core resource coap_well_known_core_default_handler writes user-provided option data and other data into a fixed size buffer without validating the buffer is large enough to contain | High 7.5 | 11 Mar 2026 |
| CVE-2026-25139 | RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. In version 2025.10 and prior, multiple out-of-bounds read allow any unauthenticated user, with ability to send or manipulate input packets, to read adjacent memory locations, or crash a vulnerable device running the 6LoWPAN stack. The received | High 8.7 | 4 Feb 2026 |
| CVE-2026-22213 | RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the tapslip6 utility. The vulnerability is caused by unsafe string concatenation in the devopen() function, which constructs a device path using unbounded user-controlled input. The utility uses strcpy() and strcat() to concatenate the fixed prefix '/dev/' with a user-supplied device name | Low 2.4 | 12 Jan 2026 |
| CVE-2026-22214 | RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the ethos utility due to missing bounds checking when processing incoming serial frame data. The vulnerability occurs in the _handle_char() function, where incoming frame bytes are appended to a fixed-size stack buffer without verifying that the current write index remains within bounds. A | Medium 6.8 | 12 Jan 2026 |
| CVE-2025-66647 | RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. A vulnerability was discovered in the IPv6 fragmentation reassembly implementation of RIOT OS v2025.07. When copying the contents of the first fragment (offset=0) into the reassembly buffer, no size check is performed. It is possible to force t | Low 1.7 | 17 Dec 2025 |
| CVE-2025-66646 | RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. A vulnerability was discovered in the IPv6 fragmentation reassembly implementation of RIOT OS v2025.07. When receiving an fragmented IPv6 packet with fragment offset 0 and an empty payload, the payload pointer is set to NULL. However, the imple | Low 1.7 | 17 Dec 2025 |
| CVE-2025-53888 | RIOT-OS, an operating system that supports Internet of Things devices, has an ineffective size check implemented with `assert()` can lead to buffer overflow in versions up to and including 2025.04. Assertions are usually compiled out in production builds. If assertions are the only defense against untrusted inputs, the software may be exposed to attacks that utilize the lack of proper input checks | Medium 6.6 | 18 Jul 2025 |
| CVE-2024-53980 | RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. A malicious actor can send a IEEE 802.15.4 packet with spoofed length byte and optionally spoofed FCS, which eventually results into an endless loop on a CC2538 as receiver. Before PR #20998, the receiver would check for the location of the CRC | Medium 6.9 | 29 Nov 2024 |
| CVE-2024-52802 | RIOT is an operating system for internet of things (IoT) devices. In version 2024.04 and prior, the function `_parse_advertise`, located in `/sys/net/application_layer/dhcpv6/client.c`, has no minimum header length check for `dhcpv6_opt_t` after processing `dhcpv6_msg_t`. This omission could lead to an out-of-bound read, causing system inconsistency. Additionally, the same lack of a header length | High 7.5 | 22 Nov 2024 |
| CVE-2024-32018 | RIOT is a real-time multi-threading operating system that supports a range of devices that are typically 8-bit, 16-bit and 32-bit microcontrollers. Most codebases define assertion macros which compile to a no-op on non-debug builds. If assertions are the only line of defense against untrusted input, the software may be exposed to attacks that leverage the lack of proper input checks. In detail, in | High 8.8 | 1 May 2024 |
| CVE-2024-31225 | RIOT is a real-time multi-threading operating system that supports a range of devices that are typically 8-bit, 16-bit and 32-bit microcontrollers. The `_on_rd_init()` function does not implement a size check before copying data to the `_result_buf` static buffer. If an attacker can craft a long enough payload, they could cause a buffer overflow. If the unchecked input above is attacker-controlled | High 8.3 | 1 May 2024 |
| CVE-2024-32017 | RIOT is a real-time multi-threading operating system that supports a range of devices that are typically 8-bit, 16-bit and 32-bit microcontrollers. The size check in the `gcoap_dns_server_proxy_get()` function contains a small typo that may lead to a buffer overflow in the subsequent `strcpy()`. In detail, the length of the `_uri` string is checked instead of the length of the `_proxy` string. The | Critical 9.8 | 1 May 2024 |
| CVE-2023-33975 | RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. In version 2023.01 and prior, an attacker can send a crafted frame to the device resulting in an out of bounds write in the packet buffer. The overflow can be used to corrupt other packets and the allocator metadata. Corrupting a pointer will easily lead to denial | Critical 9.8 | 30 May 2023 |
| CVE-2023-24826 | RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send crafted frames to the device to trigger the usage of an uninitialized object leading to denial of service. This issue is fixed in version 2023.04. As a workaround, disable fragment forwarding or SFR. | Medium 5.9 | 30 May 2023 |
| CVE-2023-33973 | RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. In versions 2023.01 and prior, an attacker can send a crafted frame which is forwarded by the device. During encoding of the packet a NULL pointer dereference occurs. This crashes the device leading to denial of service. A patch is available at pull request 19678. | High 7.5 | 30 May 2023 |
| CVE-2023-33974 | RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. In versions 2023.01 and prior, an attacker can send multiple crafted frames to the device to trigger a race condition. The race condition invalidates assumptions about the program state and leads to an invalid memory access resulting in denial of service. This iss | High 7.5 | 30 May 2023 |
| CVE-2023-24817 | RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send a crafted frame to the device resulting in an integer underflow and out of bounds access in the packet buffer. Triggering the access at the right time will corrupt other packets or the allocator metadata. Corrupting a | High 7.5 | 30 May 2023 |
| CVE-2023-24825 | RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send a crafted frame to the device to trigger a NULL pointer dereference leading to denial of service. This issue is fixed in version 2023.04. There are no known workarounds. | High 7.5 | 30 May 2023 |
| CVE-2023-24821 | RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in a large out of bounds write beyond the packet buffer. The write will create a hard fault exception after reaching the last page of RAM. The hard fault is not handled and | High 7.5 | 24 Apr 2023 |
| CVE-2023-24822 | RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in a NULL pointer dereference while encoding a 6LoWPAN IPHC header. The NULL pointer dereference causes a hard fault exception, leading to denial of service. Version 2022.10 | High 7.5 | 24 Apr 2023 |
| CVE-2023-24823 | RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in a type confusion between IPv6 extension headers and a UDP header. This occurs while encoding a 6LoWPAN IPHC header. The type confusion manifests in an out of bounds write | Critical 9.8 | 24 Apr 2023 |
| CVE-2023-24818 | RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in a NULL pointer dereference. During forwarding of a fragment an uninitialized entry in the reassembly buffer is used. The NULL pointer dereference triggers a hard fault ex | High 7.5 | 24 Apr 2023 |
| CVE-2023-24819 | RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in an out of bounds write in the packet buffer. The overflow can be used to corrupt other packets and the allocator metadata. Corrupting a pointer will easily lead to denial | Critical 9.8 | 24 Apr 2023 |
| CVE-2023-24820 | RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. An attacker can send a crafted frame to the device resulting in a large out of bounds write beyond the packet buffer. The write will create a hard fault exception after reaching the last page of RAM. The hard fault is not handled and the system will be stuck u | High 7.5 | 24 Apr 2023 |
| CVE-2021-27427 | RIOT OS version 2020.01.1 is vulnerable to integer wrap-around in its implementation of calloc function, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution. | High 7.3 | 3 May 2022 |
| CVE-2021-41061 | In RIOT-OS 2021.01, nonce reuse in 802.15.4 encryption in the ieee820154_security component allows attackers to break encryption by triggering reboots. | Medium 5.5 | 15 Sep 2021 |
| CVE-2021-31660 | RIOT-OS 2021.01 before commit 85da504d2dc30188b89f44c3276fc5a25b31251f contains a buffer overflow which could allow attackers to obtain sensitive information. | High 7.5 | 18 Jun 2021 |
| CVE-2021-31661 | RIOT-OS 2021.01 before commit 609c9ada34da5546cffb632a98b7ba157c112658 contains a buffer overflow that could allow attackers to obtain sensitive information. | High 7.5 | 18 Jun 2021 |
| CVE-2021-31662 | RIOT-OS 2021.01 before commit 07f1254d8537497552e7dce80364aaead9266bbe contains a buffer overflow which could allow attackers to obtain sensitive information. | High 7.5 | 18 Jun 2021 |
| CVE-2021-31663 | RIOT-OS 2021.01 before commit bc59d60be60dfc0a05def57d74985371e4f22d79 contains a buffer overflow which could allow attackers to obtain sensitive information. | High 7.5 | 18 Jun 2021 |
| CVE-2021-31664 | RIOT-OS 2021.01 before commit 44741ff99f7a71df45420635b238b9c22093647a contains a buffer overflow which could allow attackers to obtain sensitive information. | High 7.5 | 18 Jun 2021 |
| CVE-2021-27357 | RIOT-OS 2020.01 contains a buffer overflow vulnerability in /sys/net/gnrc/routing/rpl/gnrc_rpl_control_messages.c. | Critical 9.8 | 6 Apr 2021 |
| CVE-2021-27697 | RIOT-OS 2021.01 contains a buffer overflow vulnerability in sys/net/gnrc/routing/rpl/gnrc_rpl_validation.c through the gnrc_rpl_validation_options() function. | Critical 9.8 | 6 Apr 2021 |
| CVE-2021-27698 | RIOT-OS 2021.01 contains a buffer overflow vulnerability in /sys/net/gnrc/routing/rpl/gnrc_rpl_control_messages.c through the _parse_options() function. | Critical 9.8 | 6 Apr 2021 |
| CVE-2020-15350 | RIOT 2020.04 has a buffer overflow in the base64 decoder. The decoding function base64_decode() uses an output buffer estimation function to compute the required buffer capacity and validate against the provided buffer size. The base64_estimate_decode_size() function calculates the expected decoded size with an arithmetic round-off error and does not take into account possible padding bytes. Due t | Critical 9.8 | 7 Jul 2020 |
| CVE-2019-17389 | In RIOT 2019.07, the MQTT-SN implementation (asymcute) mishandles errors occurring during a read operation on a UDP socket. The receive loop ends. This allows an attacker (via a large packet) to prevent a RIOT MQTT-SN client from working until the device is restarted. | High 7.5 | 9 Oct 2019 |
| CVE-2019-16754 | RIOT 2019.07 contains a NULL pointer dereference in the MQTT-SN implementation (asymcute), potentially allowing an attacker to crash a network node running RIOT. This requires spoofing an MQTT server response. To do so, the attacker needs to know the MQTT MsgID of a pending MQTT protocol message and the ephemeral port used by RIOT's MQTT implementation. Additionally, the server IP address is requi | High 7.5 | 24 Sep 2019 |
| CVE-2019-15702 | In the TCP implementation (gnrc_tcp) in RIOT through 2019.07, the parser for TCP options does not terminate on all inputs, allowing a denial-of-service, because sys/net/gnrc/transport_layer/tcp/gnrc_tcp_option.c has an infinite loop for an unknown zero-length option. | High 7.5 | 27 Aug 2019 |
| CVE-2019-15134 | RIOT through 2019.07 contains a memory leak in the TCP implementation (gnrc_tcp), allowing an attacker to consume all memory available for network packets and thus effectively stopping all network threads from working. This is related to _receive in sys/net/gnrc/transport_layer/tcp/gnrc_tcp_eventloop.c upon receiving an ACK before a SYN. | High 7.5 | 17 Aug 2019 |
| CVE-2019-1000006 | RIOT RIOT-OS version after commit 7af03ab624db0412c727eed9ab7630a5282e2fd3 contains a Buffer Overflow vulnerability in sock_dns, an implementation of the DNS protocol utilizing the RIOT sock API that can result in Remote code executing. This attack appears to be exploitable via network connectivity. | Critical 9.8 | 4 Feb 2019 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 10 Last 12 months 35 Lifetime Memory safety 50 % Parsing/validation 30 % Auth bypass 12 % Info disclosure 8 % Latest advisories Loading the feed Overview RIOT is an operating system for low-power IoT hardware, built around the constrained networking protocols that mesh deployments run on: 6LoWPAN, LoRaWAN and CoAP. It came out of academic work at INRIA and FU Berlin and now carries commercial low-power meshes in metering and sensing. An unauthenticated remote firmware hijack through a buffer overflow in the SUIT CoAP trigger handler is the reference point for what a defect here costs, and two further criticals landed inside the last twelve months. The project runs a mature disclosure process with a published GPG key and no money behind it, so sorona.xyz pays you directly on qualified, reproduced findings. In scope The policy asks for any security issue by private mail to the project security address, publishes a GPG key for it and sets out declassification rules. It draws no boundary narrower than the RIOT tree itself The kernel: the scheduler, threading, inter-process communication, mutexes and the memory allocators The GNRC network stack end to end, covering IPv6, 6LoWPAN fragmentation and reassembly, UDP, TCP and the neighbour-discovery layer CoAP handling in nanocoap and gcoap, including option parsing, block-wise transfer and the observe mechanism The DHCPv6 client and the other network configuration clients that act on unauthenticated responses from the network SUIT firmware update handling: the CoAP trigger path, manifest parsing, signature verification and the flash write that follows LoRaWAN and the IEEE 802.15.4 radio drivers, along with the link-layer code that parses frames straight off the air The Bluetooth Low Energy integration and the other wireless transports in the tree The cryptographic modules and the PSA Crypto implementation, together with the DTLS and TLS integrations Filesystem support, storage drivers and the flash abstraction underneath them The USB device stack and the shell reachable over serial, which a great many deployments leave enabled Peripheral and sensor drivers in the tree, which parse data from hardware an attacker may control Out of scope Downstream products and vendor forks built on RIOT rather than the upstream tree Application code written against RIOT that misuses an API in a way the documentation warns against Board configurations that deliberately leave a debug shell or an unauthenticated service enabled Third-party packages pulled in through the package system, unless RIOT's own use of them is what makes the defect reachable Physical attacks on a node an attacker already holds, including reading flash over a debug port Denial of service that amounts to jamming the radio or flooding the link Most-valued findings Anything that gets attacker-chosen firmware onto a node. The SUIT CoAP trigger handler overflow was exactly that, an unauthenticated remote firmware hijack, and it is the highest-value class this project has Memory corruption in CoAP parsing, the shape the critical nanocoap Block2 integer overflow took when block-wise transfer handling reached out of bounds Integer underflow and missing length checks in network configuration clients, the class CVE-2026-49868 landed in when the DHCPv6 client skipped a sub-option length check and produced an unbounded copy Anything in the 6LoWPAN fragmentation and reassembly path, where the attacker supplies the fragments from within radio range Link-layer and radio driver parsing, reachable by anyone with a transmitter nearby and no credential at all Signature verification and manifest handling in SUIT, since that is the only thing deciding which firmware a node will accept Cryptographic defects in the PSA Crypto implementation or the DTLS integration, which constrained devices lean on entirely for confidentiality on the wire Anything reachable before a node joins a network, since commissioning is when these devices are least protected and most exposed Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report to [email protected] , the address the SECURITY.md names, or through GitHub private vulnerability reporting on RIOT-OS/RIOT Encrypt to the project GPG key, fingerprint 44C6AE441172F88D3423E81F5F7964D0F4239033, published at riot-os.org/assets/keys/security.asc The policy commits to a response within one week, so a silence longer than that is worth chasing rather than assuming The project runs a Trusted RIOT Users tier that is notified ahead of the public, and it discloses publicly two weeks after the fixed release Name the board and the network stack you reproduced on. GNRC and the alternative stacks take different code paths and a defect may only be reachable through one of them Say which transport carried the input: an attack reachable over the radio and one needing a wired link are different findings on this class of hardware No money language appears anywhere in the policy and the project is on no bounty platform, so there is no payment to negotiate upstream Disclosure Coordinated privately by email or through GitHub, with documented declassification rules, a Trusted RIOT Users tier notified ahead of the public, and a two-week window between the fixed release and public disclosure. Ten advisories landed in the last twelve months against thirty-five ever published, so the pipeline is active and moving quickly. Hold detail until that two-week window has run, and expect deployed nodes to stay vulnerable well past it since most low-power mesh hardware is never reflashed. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability