Unbound

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Separately, for a merged upstream patch : up to $5,000 Google Patch Rewards pays for a patch you get accepted upstream and that stays merged, without reverts, for one month, not for the report. Unbound qualifies at Tier 2 through its OSS-Fuzz integration, so the ceiling is $5,000 and not the $15,000 Tier 1 headline. Merge latency is the best in its category here: upstream pushes daily and the lead maintainer is the named OSS-Fuzz contact. Patches must be one to twelve months old at submission, three a month per person, and sanctions and territory exclusions apply. CVE history 39 Last 12 months 72 Lifetime Denial of service 40 % Parsing/validation 25 % Memory safety 20 % Info disclosure 10 % Latest advisories Loading the feed Overview Unbound is the default validating recursive resolver on OpenBSD and FreeBSD, the out-of-the-box DNS service inside pfSense and OPNsense, and the engine behind a large share of ISP, enterprise and public recursive infrastructure. It is the principal non-BIND recursive implementation, which makes the recursive layer a duopoly with Unbound as half of it. KeyTrap, CVE-2023-50387, is the reference point for what a bug here costs: a valid-looking signed response that made validators burn unbounded work across that whole layer. NLnet Labs attaches no reward to its security-report page and pays nothing for a finding, so sorona.xyz pays you directly on qualified, reproduced findings. In scope NLnet Labs takes any defect in Unbound itself through GitHub private vulnerability reporting on NLnetLabs/unbound, subject to its published policy on machine-generated reports. Operator configuration sits outside that; the resolver daemon in full sits inside it Recursive resolution and cache handling end to end: cache poisoning, the NXNSAttack and unbounded-delegation class, and the aggressive-NSEC synthesis path where Unbound answers from something it derived DNSSEC validation in full, including the algorithmic-complexity surface where a valid-looking signed response costs the validator unbounded work The iterator module's referral and glue handling, the one place a hostile authoritative server gets to choose the input directly Every transport the daemon terminates, DoT, DoH and DoQ included, each of which parses connection and framing state before any DNS logic runs unbound-control and the remote-control TLS channel, an authenticated administrative interface and therefore a privilege boundary Out of scope Operator misconfiguration such as open recursion or a missing access-control statement, which are deployment decisions NSD, the authoritative sibling, which is a separate project with no funding pathway of its own Downstream distribution patches and vendored forks, including those carried by pfSense and OPNsense, rather than defects in upstream Unbound Query-flood denial of service with no algorithmic defect behind it. Volume alone is not a bug One-line patches that fix non-exploitable crashes, including crashes that only amount to resource exhaustion, which the Patch Rewards rules say will not generally be rewarded Most-valued findings An algorithmic denial of service where a small hostile response makes the resolver do unbounded work, the KeyTrap (CVE-2023-50387) and DNSBomb shape. This is 40% of Unbound's history and the class the project is most exposed to DNSSEC validation bypass that makes an unsigned or badly signed answer verify, because Unbound is half the validating recursive layer and that guarantee is the whole point of running it Cache poisoning in the cache-fill or aggressive-NSEC synthesis path, in the CVE-2025-5994 shape, which gets a forged record served to every client behind the resolver Memory corruption in the iterator's referral and glue handling, reachable by an attacker who simply runs the authoritative server for a domain someone looks up Parsing or state-machine defects in DoT, DoH or DoQ termination, the newest transport code and the part that runs before any DNS-level sanity checking Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report through GitHub private vulnerability reporting on NLnetLabs/unbound, with the query sequence or hostile-delegation setup that reproduces it Show a defect in Unbound rather than an operator choice. Open recursion or a missing access-control statement is configuration rather than a bug NLnet Labs publishes an explicit LLM policy governing machine-generated reports; read it before submitting anything an assistant helped produce, and verify every claim yourself If you also want the Google patch money, land the fix upstream yourself and keep it merged without reverts for one month. That is a separate pathway with its own rules On that pathway Unbound is Tier 2 through OSS-Fuzz, so the patch ceiling is $5,000 rather than the $15,000 Tier 1 headline; patches must be one to twelve months old and are capped at three per person per month Google cannot pay anyone on a sanctions list, in a sanctioned territory, or located in Russia or Belarus Disclosure Coordinated with NLnet Labs through GitHub private vulnerability reporting; upstream is unusually responsive and ships fixes quickly. If the defect is protocol-level and reaches other implementations, it routes into an ISC-hosted multi-vendor confidential tracker covering Knot, PowerDNS and others, which lengthens the embargo without adding any money. Plan the timeline around that. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability