s2n-tls

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 2 Last 12 months 15 Lifetime Protocol state handling 35 % Resource exhaustion 30 % Memory safety 20 % Side channel / timing 15 % Latest advisories Loading the feed Overview s2n-tls is Amazon's TLS implementation, written to keep the protocol surface small, and it terminates TLS across large parts of the AWS fleet along with a set of external adopters. CVE-2026-16318 is the reference point for the class this codebase produces: a memory leak in QUIC transport parameter handling during HelloRetryRequest, reachable by a peer that simply asks for a retry. It shipped alongside a second finding where TLS 1.3 encrypted records were dropped silently. Reports go to the AWS Vulnerability Disclosure Program, which accepts submissions and offers no bounty, and the paid Amazon programme does not cover source code. sorona.xyz pays you directly on qualified, reproduced findings. In scope The published policy asks for any security issue in s2n-tls through the AWS VDP and sets out a shared-responsibility threat model rather than a narrowed component list, so the whole library is the target The TLS 1.2 and TLS 1.3 handshake state machines, covering message ordering, transitions and every state a peer can drive the connection into The record layer: fragmentation, reassembly, padding handling, sequence numbers and the encrypt and decrypt paths on both sides The QUIC integration and its transport parameter handling, including HelloRetryRequest and the retry paths that recent findings landed in Certificate handling end to end: chain validation, hostname verification, OCSP stapling, certificate transparency handling and client certificate authentication Session resumption in both forms, session tickets and pre-shared keys, along with the early data path and its replay properties The named security policies and the cipher preference machinery, where a policy that permits something it advertises as forbidden is a defect in itself Key derivation and the key schedule, including rekeying and the handling of exporter secrets The public C API and the callback surface that embedders hook into, where a caller following the documentation still ends up insecure The bindings and helper crates shipped in this repository, including the Rust bindings that external adopters increasingly use Out of scope AWS services and their configuration rather than a defect in this library Amazon retail, device and consumer application reports, which the AWS VDP policy sends to a separate programme Weaknesses in the underlying libcrypto rather than in s2n-tls's use of it; those belong with AWS-LC, OpenSSL or whichever backend is linked Behaviour the shared-responsibility threat model assigns to the calling application, unless the documentation leads a careful caller into it Attacks that assume a compromised host or an attacker who already holds the private key Most-valued findings Handshake state machine defects where a peer drives the connection into a state the specification forbids. CVE-2026-16317 is the recent shape: TLS 1.3 encrypted records dropped silently rather than treated as a protocol violation Anything a remote peer can use to grow memory or CPU without limit. CVE-2026-16318 leaked memory in QUIC transport parameter handling during HelloRetryRequest, and a leak in a fleet-wide TLS terminator scales with the connection count Certificate or hostname validation that accepts a chain it should reject, since s2n-tls is the client side as well as the server side in a great deal of AWS internal traffic Session resumption and early data defects, particularly anything that lets replayed early data reach the application or lets one session's material be used for another A named security policy that permits a version, curve or cipher it advertises as excluded, because operators pick these policies precisely to make a guarantee Timing or other side channel signals in record processing or in the handshake, on a codebase that treats constant-time behaviour as a stated goal Memory safety defects reachable from a peer-controlled record or extension, which remain the highest-severity class in any C TLS implementation Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report through the AWS Vulnerability Disclosure Program on HackerOne or by email to [email protected] , the two channels SECURITY.md names Read the shared-responsibility threat model published in SECURITY.md before writing the report; it sets out what the library treats as its own problem and what it hands back to the caller The AWS VDP is open and pays nothing, and Amazon's paid programme has no source code in its scope, so there is no reward to negotiate here State the protocol version and the transport. QUIC and TLS 1.3 paths behave differently in this codebase and the recent findings split across both Give the negotiated configuration by name. s2n-tls exposes security policies as named bundles, and a defect often exists only under one of them For anything resource-related, show the growth per connection rather than a single observation, since the practical impact of a leak in a TLS terminator is set by how it scales Disclosure Coordinated with the AWS security team through the VDP and published as a GitHub Security Advisory on aws/s2n-tls alongside a release carrying the fix. Fifteen advisories over the project's life put this among the more active publishers in the category, and the July 2026 pair went out on the same day, so expect a batched release rather than a per-finding one. Hold the detail until that release is out. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability