Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Varnish / Vinyl Cache

By Vinyl Cache Bug bounty on Sorona vinyl-cache.org

Accepting reports open-source
Go to program Website
Top reward
$1,500
Top severity paid
Critical
Assets in scope
13
Public CVEs
19
Last change
No changes yet

At a glance

What to know before you start testing.

Pays from $1,500
for critical bugs.
Report on Sorona
Submit through the program page.
Partial safe harbor
Some legal protection; read the terms.
Publish after a fix
Coordinate the timing with the company.

Rewards

What Sorona lists as the payout for each severity.

Severity Reward
Critical $1,500+
High $700+
Medium $300+
Low $100 $100 / 1 month Claude Max
Safe harbor
Partial Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.

Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

13 assets you may test, 6 excluded.

Web 1

  • https://vinyl-cache.org

Products and areas 12

  • Ban and purge handling, and the expressions an operator or an API call can submit through them
  • HTTP/1.1 request and response parsing in the daemon, covering request targets in absolute and origin form, framing headers, chunked bodies and connection reuse
  • HTTP/2 support: frame handling, HPACK, stream state, flow control, and the translation into the internal request representation
  • The backend fetch path, including connection reuse to origins and how a backend response is parsed and trusted
  • The cache itself: object keying, hashing, Vary handling and variant selection, which together decide which stored object a request receives
  • The ESI parser and the assembly of edge-included fragments into a response
  • The security page takes reports by direct email to the named maintainers with published GPG keys, and covers the cache itself rather than a named component list. Varnish Software's address is listed alongside and the two sides coordinate on the same issues
  • The shared memory log and the tools that consume it, varnishlog, varnishncsa and the rest
  • The storage engines and their allocation behaviour under adversarial object sizes and counts
  • The varnishd management process, the CLI interface and the authentication on it
  • The VMOD ABI and the VMODs shipped with the project
  • VCL compilation and the C code it generates, and the boundary between operator-authored VCL and the daemon it is compiled into
Out of scope (6)
  • Denial of service proportional to connection volume with no amplification factor
  • Origin servers and their behaviour
  • The commercial Varnish Enterprise product, though a shared defect will be coordinated across both under the 2026 agreement
  • Third-party VMODs not shipped with the project
  • Tooling in the archived varnishcache/varnish-cache repository, as distinct from current Vinyl Cache code
  • VCL an operator wrote that expresses an unsafe policy correctly

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.

While testing

  • Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
  • Track vinyl-cache.org. The open source project renamed to Vinyl Cache at 9.0 and varnishcache/varnish-cache on GitHub is archived, so its issue tracker is not a reporting channel
  • Report by direct email to the named maintainers, who publish GPG keys for this purpose. varnish.org additionally lists the address on the policy page and the address on the policy page
  • State every affected line explicitly. Advisories here routinely span 6.0 LTS, 7.x, 8.0 and 9.0, and the LTS line is what most production actually runs
  • Send the raw request or response bytes. Every recent finding turned on how a specific byte sequence was parsed
  • Say whether the defect is in the daemon, in a path generated from VCL, or in a VMOD, because a VMOD is frequently somebody else's code
  • Expect the finding to be handled jointly. Varnish Software and the Vinyl maintainers agreed in early 2026 to coordinate security handling and publish under common identifiers
  • Neither the project nor Varnish Software pays for a report, and there is no bounty on any platform

Not accepted

  • Third-party VMODs not shipped with the project
  • VCL an operator wrote that expresses an unsafe policy correctly
  • The commercial Varnish Enterprise product
  • Tooling in the archived varnishcache/varnish-cache repository
  • Origin servers and their behaviour
  • Denial of service proportional to connection volume with no amplification factor

Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 36 minutes ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD
CVESeverityPublished
CVE-2026-40396 Medium 4.0 12 Apr 2026
CVE-2026-40394 Medium 4.0 12 Apr 2026
CVE-2026-34475 Medium 5.4 27 Mar 2026

Original policy

Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 4 Last 12 months 19 Lifetime Request smuggling 40 % Parsing/validation 35 % Denial of service 20 % Latest advisories Loading the feed Overview Varnish is the HTTP accelerator sitting in front of large publishing and CDN estates, absorbing traffic before it reaches an origin. The open source project is now called Vinyl Cache, at 9.0.x, after a split with Varnish Software; the old GitHub repository is archived and the two sides agreed in February 2026 to keep publishing under common VSV and CVE identifiers. CVE-2026-50052 is the reference point: an HTTP/2 parsing deficiency reaching back through 8.0, 7.6 and the 6.0 LTS line that a lot of production still runs. Four advisories in twelve months, all in the parsing and smuggling family, and nothing paid by either side of the split. sorona.xyz pays you directly on qualified, reproduced findings. In scope The security page takes reports by direct email to the named maintainers with published GPG keys, and covers the cache itself rather than a named component list. Varnish Software's address is listed alongside and the two sides coordinate on the same issues HTTP/1.1 request and response parsing in the daemon, covering request targets in absolute and origin form, framing headers, chunked bodies and connection reuse HTTP/2 support: frame handling, HPACK, stream state, flow control, and the translation into the internal request representation The cache itself: object keying, hashing, Vary handling and variant selection, which together decide which stored object a request receives VCL compilation and the C code it generates, and the boundary between operator-authored VCL and the daemon it is compiled into The backend fetch path, including connection reuse to origins and how a backend response is parsed and trusted Ban and purge handling, and the expressions an operator or an API call can submit through them The ESI parser and the assembly of edge-included fragments into a response The VMOD ABI and the VMODs shipped with the project The varnishd management process, the CLI interface and the authentication on it The shared memory log and the tools that consume it, varnishlog, varnishncsa and the rest The storage engines and their allocation behaviour under adversarial object sizes and counts Out of scope Third-party VMODs not shipped with the project VCL an operator wrote that expresses an unsafe policy correctly The commercial Varnish Enterprise product, though a shared defect will be coordinated across both under the 2026 agreement Tooling in the archived varnishcache/varnish-cache repository, as distinct from current Vinyl Cache code Origin servers and their behaviour Denial of service proportional to connection volume with no amplification factor Most-valued findings Request smuggling and desync, whether between Varnish and the front end or between Varnish and the origin. CVE-2025-47905 came out of that family and it remains the codebase's most productive class HTTP/2 parsing and state defects, the CVE-2026-50052 shape, and particularly anything that behaves differently on the 6.0 LTS line than on 9.0 Request-target parsing, absolute-form handling above all, the CVE-2026-34475 class, since the parsed target is what the cache key is built from Cache poisoning through key derivation, Vary handling or a variant collision, because one poisoned object is then served to every subsequent client Flow-control and reset accounting in HTTP/2 where a cheap client action costs the server a great deal, the class CVE-2025-8671 landed in Anything that lets a client reach the CLI or the management interface, or read the shared memory log, which carries other people's requests in full ESI parsing defects, given that edge-included fragments are assembled from markup an attacker may have influenced upstream Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Track vinyl-cache.org. The open source project renamed to Vinyl Cache at 9.0 and varnishcache/varnish-cache on GitHub is archived, so its issue tracker is not a reporting channel Report by direct email to the named maintainers, who publish GPG keys for this purpose. varnish.org additionally lists [email protected] and [email protected] State every affected line explicitly. Advisories here routinely span 6.0 LTS, 7.x, 8.0 and 9.0, and the LTS line is what most production actually runs Send the raw request or response bytes. Every recent finding turned on how a specific byte sequence was parsed Say whether the defect is in the daemon, in a path generated from VCL, or in a VMOD, because a VMOD is frequently somebody else's code Expect the finding to be handled jointly. Varnish Software and the Vinyl maintainers agreed in early 2026 to coordinate security handling and publish under common identifiers Neither the project nor Varnish Software pays for a report, and there is no bounty on any platform Disclosure Coordinated by email with the maintainers under GPG, then published as a numbered VSV advisory with a CVE attached. Varnish Software and the Vinyl Cache maintainers agreed in early 2026 to keep handling security issues together and to publish under common identifiers, so a finding here is fixed on both sides rather than in one fork. The series runs to VSV00019 and is the record to read before reporting, because it shows exactly which release lines an advisory is expected to name. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability