- Top reward
- $100,000
- Top severity paid
- Not published
- Assets in scope
- 22
- Public CVEs
- 37
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $100,000
- top reward, from $100.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Top reward
-
$100,000
Protocol-level issues may be eligible for rewards of up to $100,000 or more.
- Lowest reward
-
$100
In general, app-level changes can expect bounties ranging from $100 to $10,000 .
- Safe harbor
-
Full
Telegram will not take legal action against anyone who responsibly researches and discloses vulnerabilities in accordance with our rules.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
22 assets you may test, 5 excluded.
Wildcard domains 10
- *.stel.com
- *.telegram.me
- telegram.me, *.telegram.me
- *.telegram.org
- telegram.org, *.telegram.org
- *.telesco.pe
- *.tg.dev
- tg.dev, *.tg.dev
- *.t.me
- t.me, *.t.me
Domains 9
- contest.com
- quiz.directory
- stel.com
- telegram.me
- telegram.org
- telegra.ph
- telesco.pe
- tg.dev
- t.me
Products and areas 3
- MTProto 2.0
- Official Telegram apps
- Telegram domains
Out of scope (5)
- https://core.telegram.org/bots/api
- core.telegram.org/schema
- Apps developed by third parties using the open Telegram API
- bots running under Telegram's Bot API
- Third-party domains that integrate Telegram pages or services
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Telegram's policy. "We" in these lines means the program, not this site.
While testing
-
Your testing cannot violate any law , disrupt Telegram's services or negatively affect other users in any way.
-
Vulnerabilities that are disclosed to the public or to third parties before they are addressed are not eligible for our bug bounty program.
-
Attempting to gain physical access to any of Telegram’s equipment is strictly prohibited.
-
you are not allowed to perform any such action on our services.
-
An issue may only be submitted once .
-
We expect all reports to be written in English and to follow a consistent template , spacing included
-
We ask for all submissions and correspondence to be sent directly to [email protected]
Not accepted
-
Phishing attacks, spam
-
Token or session hijacking as a result of external malware on the OS
-
Irrelevant reports from scanners or automated tools
-
Attacks requiring physical access to the user's device
-
Missing cookie flags (HttpOnly, Secure, etc.)
-
Attacks requiring root access to the user's device
-
Clickjacking
-
Non-reproducible vulnerabilities deriving from outdated or reportedly flawed versions of open-source software
-
Vulnerabilities that rely on social engineering to either obtain sensitive credentials or have the user perform an unlikely sequence of actions
-
Presence of banner or version information, SSL/TLS best practices, etc.
-
denial of service or load balancing issues resulting from spam, brute forcing, coordinated DDoS attacks, etc.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2021-47793 | Telegram Desktop 2.9.2 contains a denial of service vulnerability that allows attackers to crash the application by sending an oversized message payload. Attackers can generate a 9 million byte buffer and paste it into the messaging interface to trigger an application crash. | Medium 4.6 | 16 Jan 2026 |
| CVE-2024-7014 | EvilVideo vulnerability allows sending malicious apps disguised as videos in Telegram for Android application affecting versions 10.14.4 and older. | High 7.1 | 23 Jul 2024 |
| CVE-2023-34658 | Telegram v9.6.3 on iOS allows attackers to hide critical information on the User Interface via calling the function SFSafariViewController. | Medium 5.3 | 29 Jun 2023 |
| CVE-2023-26818 | Telegram 9.3.1 and 9.4.0 allows attackers to access restricted files, microphone ,or video recording via the DYLD_INSERT_LIBRARIES flag. | Medium 5.5 | 19 May 2023 |
| CVE-2022-43363 | Telegram Web 15.3.1 allows XSS via a certain payload derived from a Target Corporation website. NOTE: some third parties have been unable to discern any relationship between the Pastebin information and a possible XSS finding. | Medium 6.1 | 6 Dec 2022 |
| CVE-2021-41861 | The Telegram application 7.5.0 through 7.8.0 for Android does not properly implement image self-destruction, a different vulnerability than CVE-2019-16248. After approximately two to four uses of the self-destruct feature, there is a misleading UI indication that an image was deleted (on both the sender and recipient sides). The images are still present in the /Storage/Emulated/0/Telegram/Telegram | Low 3.3 | 4 Oct 2021 |
| CVE-2021-40532 | Telegram Web K Alpha before 0.7.2 mishandles the characters in a document extension. | Critical 9.8 | 6 Sep 2021 |
| CVE-2021-37596 | Telegram Web K Alpha 0.6.1 allows XSS via a document name. | Medium 6.1 | 30 Jul 2021 |
| CVE-2021-36769 | A reordering issue exists in Telegram before 7.8.1 for Android, Telegram before 7.8.3 for iOS, and Telegram Desktop before 2.8.8. An attacker can cause the server to receive messages in a different order than they were sent a client. | Medium 5.3 | 17 Jul 2021 |
| CVE-2021-31315 | Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the blit function of their custom fork of the rlottie library. A remote attacker might be able to access Telegram's stack memory out-of-bounds on a victim device via a malicious animated sticker. | Medium 5.5 | 18 May 2021 |
| CVE-2021-31317 | Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the VDasher constructor of their custom fork of the rlottie library. A remote attacker might be able to access Telegram's heap memory out-of-bounds on a victim device via a malicious animated sticker. | Medium 5.5 | 18 May 2021 |
| CVE-2021-31318 | Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the LOTCompLayerItem::LOTCompLayerItem function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker. | Medium 5.5 | 18 May 2021 |
| CVE-2021-31319 | Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by an Integer Overflow in the LOTGradient::populate function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker. | Medium 5.5 | 18 May 2021 |
| CVE-2021-31320 | Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the VGradientCache::generateGradientColorTable function of their custom fork of the rlottie library. A remote attacker might be able to overwrite heap memory out-of-bounds on a victim device via a malicious animated sticker. | High 7.1 | 18 May 2021 |
| CVE-2021-31321 | Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the gray_split_cubic function of their custom fork of the rlottie library. A remote attacker might be able to overwrite Telegram's stack memory out-of-bounds on a victim device via a malicious animated sticker. | High 7.1 | 18 May 2021 |
| CVE-2021-31322 | Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the LOTGradient::populate function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker. | Medium 5.5 | 18 May 2021 |
| CVE-2021-31323 | Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the LottieParserImpl::parseDashProperty function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker. | Medium 5.5 | 18 May 2021 |
| CVE-2021-30496 | The Telegram app 7.6.2 for iOS allows remote authenticated users to cause a denial of service (application crash) if the victim pastes an attacker-supplied message (e.g., in the Persian language) into a channel or group. The crash occurs in MtProtoKitFramework. NOTE: the vendor's perspective is that "this behavior can't be considered a vulnerability." | Medium 5.7 | 20 Apr 2021 |
| CVE-2021-27351 | The Terminate Session feature in the Telegram application through 7.2.1 for Android, and through 2.4.7 for Windows and UNIX, fails to invalidate a recently active session. | Medium 5.3 | 19 Feb 2021 |
| CVE-2021-27204 | Telegram before 7.4 (212543) Stable on macOS stores the local passcode in cleartext, leading to information disclosure. | Medium 5.5 | 12 Feb 2021 |
| CVE-2021-27205 | Telegram before 7.4 (212543) Stable on macOS stores the local copy of self-destructed messages in a sandbox path, leading to sensitive information disclosure. | Medium 5.5 | 12 Feb 2021 |
| CVE-2020-25824 | Telegram Desktop through 2.4.3 does not require passcode entry upon pushing the Export key within the Export Telegram Data wizard. The threat model is a victim who has voluntarily opened Export Wizard but is then distracted. An attacker then approaches the unattended desktop and pushes the Export key. This attacker may consequently gain access to all chat conversation and media files. | Low 2.4 | 14 Oct 2020 |
| CVE-2020-17448 | Telegram Desktop through 2.1.13 allows a spoofed file type to bypass the Dangerous File Type Execution protection mechanism, as demonstrated by use of the chat window with a filename that lacks an extension. | High 7.8 | 11 Aug 2020 |
| CVE-2020-12474 | Telegram Desktop through 2.0.1, Telegram through 6.0.1 for Android, and Telegram through 6.0.1 for iOS allow an IDN Homograph attack via Punycode in a public URL or a group chat invitation URL. | Medium 6.5 | 1 May 2020 |
| CVE-2020-10570 | The Telegram application through 5.12 for Android, when Show Popup is enabled, might allow physically proximate attackers to bypass intended restrictions on message reading and message replying. This might be interpreted as a bypass of the passcode feature. | Medium 6.1 | 24 Mar 2020 |
| CVE-2019-16248 | The "delete for" feature in Telegram before 5.11 on Android does not delete shared media files from the Telegram Images directory. In other words, there is a potentially misleading UI indication that a sender can remove a recipient's copy of a previously sent image (analogous to supported functionality in which a sender can remove a recipient's copy of a previously sent message). | Medium 5.5 | 11 Sep 2019 |
| CVE-2019-15514 | The Privacy > Phone Number feature in the Telegram app 5.10 for Android and iOS provides an incorrect indication that the access level is Nobody, because attackers can find these numbers via the Group Info feature, e.g., by adding a significant fraction of a region's assigned phone numbers. | Medium 5.3 | 23 Aug 2019 |
| CVE-2019-10044 | Telegram Desktop before 1.5.12 on Windows, and the Telegram applications for Android, iOS, and Linux, is vulnerable to an IDN homograph attack when displaying messages containing URLs. This occurs because the application produces a clickable link even if (for example) Latin and Cyrillic characters exist in the same domain name, and the available font has an identical representation of characters f | High 8.8 | 25 Mar 2019 |
| CVE-2018-3986 | An exploitable information disclosure vulnerability exists in the "Secret Chats" functionality of the Telegram Android messaging application version 4.9.0. The "Secret Chats" functionality allows a user to delete all traces of a chat, either by using a time trigger or by direct request. There is a bug in this functionality that leaves behind photos taken and shared on the secret chats, even after | Medium 5.5 | 3 Jan 2019 |
| CVE-2018-20436 | The "secret chat" feature in Telegram 4.9.1 for Android has a "side channel" in which Telegram servers send GET requests for URLs typed while composing a chat message, before that chat message is sent. There are also GET requests to other URLs on the same web server. This also affects one or more other Telegram products, such as Telegram Web-version 0.7.0. In addition, it can be interpreted as an | High 8.1 | 24 Dec 2018 |
| CVE-2018-15543 | An issue was discovered in the org.telegram.messenger application 4.8.11 for Android. The FingerprintManager class for Biometric validation allows authentication bypass through the callback method from onAuthenticationFailed to onAuthenticationSucceeded with null, because the fingerprint API in conjunction with the Android keyGenerator class is not implemented. In other words, an attacker could au | Medium 6.8 | 9 Oct 2018 |
| CVE-2018-15542 | An issue was discovered in the org.telegram.messenger application 4.8.11 for Android. The Passcode feature allows authentication bypass via runtime manipulation that forces a certain method's return value to true. In other words, an attacker could authenticate with an arbitrary passcode. NOTE: the vendor indicates that this is not an attack of interest within the context of their threat model, whi | Medium 6.4 | 9 Oct 2018 |
| CVE-2018-17780 | Telegram Desktop (aka tdesktop) 1.3.14, and Telegram 3.3.0.0 WP8.1 on Windows, leaks end-user public and private IP addresses during a call because of an unsafe default behavior in which P2P connections are accepted from clients outside of the My Contacts list. | Medium 6.5 | 29 Sep 2018 |
| CVE-2018-17613 | Telegram Desktop (aka tdesktop) 1.3.16 alpha, when "Use proxy" is enabled, sends credentials and application data in cleartext over the SOCKS5 protocol. | Critical 9.8 | 28 Sep 2018 |
| CVE-2018-17231 | Telegram Desktop (aka tdesktop) 1.3.14 might allow attackers to cause a denial of service (assertion failure and application exit) via an "Edit color palette" search that triggers an "index out of range" condition. NOTE: this issue is disputed by multiple third parties because the described attack scenario does not cross a privilege boundary | High 7.5 | 19 Sep 2018 |
| CVE-2017-17715 | The saveFile method in MediaController.java in the Telegram Messenger application before 2017-12-08 for Android allows directory traversal via a pathname obtained in a file-transfer request from a remote peer, as demonstrated by writing to tgnet.dat or tgnet.dat.bak. | High 8.8 | 16 Dec 2017 |
| CVE-2014-8688 | An issue was discovered in Telegram Messenger 2.6 for iOS and 1.8.2 for Android. Secret chat messages are available in cleartext in process memory and a .db file. | High 7.5 | 14 Mar 2017 |