RocksDB

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Minimum award, where Meta pays a bounty at all │ $500 │ $625 Maximum: discretionary, no published ceiling for open source │ not published │ not published Submit a vulnerability CVE history 0 Last 12 months 2 Lifetime Memory safety 45 % Parsing/validation 20 % Denial of service 20 % Info disclosure 10 % Latest advisories Loading the feed Overview RocksDB is the most widely embedded persistent key-value engine in existence, and it is almost invisible for exactly that reason: it is the storage layer under MySQL's MyRocks, TiKV and therefore TiDB, Apache Flink's state backend, Kafka Streams' state stores, Ceph BlueStore's metadata, Apache Samza, LinkedIn's Venice, a long list of blockchain nodes, and Meta's own fleet. Its two lifetime CVEs badly understate the exposure, because a RocksDB defect is almost always filed as a bug in whatever product embedded it rather than against RocksDB itself. What makes it a target is the shape of its untrusted input: a memory-safety bug in block, SST or write-ahead-log parsing is reachable in any system that lets an attacker influence the bytes that get stored, or that opens an SST file or backup someone else produced. Meta pays cash for a report through its own bug bounty, and the open-source category is covered by an organisation-wide repository rule rather than a per-project listing. Be clear-eyed about the number, though: the published minimum is $500, Meta sets severity itself, and no payout guideline covers open source, so no maximum award is published in advance. sorona.xyz adds 1.25× on top of whatever Meta awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Meta's open-source scope names organisations rather than projects. In scope, verbatim: "Code repos: https://github.com/facebook/ https://github.com/facebookincubator/". Every non-archived repository under those two prefixes is eligible, and facebook/rocksdb sits inside the first The whole RocksDB engine as the project ships it: the write path and the write-ahead log, memtables, compaction, the block-based and plain table formats, the block cache, and the read path across iterators and snapshots Column families, transactions in both the optimistic and pessimistic flavours, checkpoints, backups and SST file ingestion, all of which read state some other process or machine produced The compression and checksum codec wrappers around Snappy, zlib, LZ4 and ZSTD, and the encryption-at-rest Env The extension points embedders plug into: comparators, merge operators, compaction filters, table factories, and the custom Env and FileSystem interfaces The bindings and tools carried in the repository: the C API, RocksJava, ldb and sst_dump Options handling and the OPTIONS file parser, which is how an embedder's configuration reaches the engine The rest of the organisation the same scope row covers, facebook/zstd and facebook/folly among them, both of which RocksDB itself builds against Out of scope Everything under github.com/facebookarchive/ , which the same scope row names as ineligible, and facebook/mysql-5.6 (MyRocks), which is itself archived despite being the flagship RocksDB consumer Extremely low-risk findings, which Meta states may not qualify for a bounty at all regardless of how neatly they reproduce Non-security correctness bugs in the storage engine: data loss, wrong compaction behaviour or a broken iterator with no security consequence belong on the issue tracker Meta's general programme exclusions, covering spam, social engineering, volumetric denial of service and physical attacks API misuse by the embedding application: options set wrongly, documented preconditions violated, or a handle used after the caller already closed it Third-party code the embedders own rather than the engine, since a bug in TiKV or Ceph BlueStore around RocksDB belongs to that project Researchers resident in US-sanctioned countries, who are ineligible, and every award is screened against trade sanctions before it is paid Most-valued findings Remotely reachable memory corruption in block, SST or write-ahead-log parsing driven by data an attacker influenced. Memory safety is 45% of RocksDB's recorded distribution and the class most likely to clear Meta's discretionary bar Integer overflow or truncation in block-handle, size or offset arithmetic that produces an undersized allocation and then a heap overflow on the following copy A malicious ingested SST file or restored backup that gives code execution the moment the database opens it, the one path where an attacker fully controls the input format Use-after-free in iterator, snapshot or column-family lifetime handling that an attacker can steer deterministically by timing requests against the embedding service Malformed keys or bounds walking a read past its buffer through the comparator, merge-operator or iterator paths, where the engine trusts an embedder-supplied callback to stay in range Any of the above demonstrated end to end through a product that actually embeds RocksDB, MyRocks, TiKV, Ceph BlueStore, Flink or Kafka Streams state among them, because that is what turns a library defect into a remotely reachable one and Meta scores on impact rather than on ubiquity Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. File through the report form at bugbounty.meta.com; Meta asks that you not contact its staff directly or through any other channel about a report Awards are entirely at Meta's discretion and Meta determines severity: no published payout guideline covers open source, so no maximum is published in advance Only non-archived repositories under https://github.com/facebook/ and https://github.com/facebookincubator/ are eligible; facebook/rocksdb qualifies, but facebook/mysql-5.6 (MyRocks) is itself archived and everything under github.com/facebookarchive/ is out The report has to describe a security vulnerability rather than a functional bug, and Meta states that extremely low-risk issues may not qualify for a bounty at all Researchers resident in US-sanctioned countries are ineligible, and Meta screens every award against trade sanctions before paying it Google Patch Rewards separately lists rocksdb at Tier 2, $5,000 for a patch you land upstream and keep merged: that is a different piece of work from the report, with its own rules and its own routing terms Disclosure Coordinated with Meta, on Meta's clock. Its terms ask for reasonable time to investigate and mitigate before you disclose publicly or share the report with others, Meta alone judges what is reasonable, and because that clause reaches private transfer as well as publication, file with Meta directly first. A fix here also has to travel downstream into MyRocks, TiKV, Ceph and every other embedder, so the practical embargo is longer than a single release. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability