Wireshark

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Separately, for a merged upstream patch : up to $5,000 Google Patch Rewards pays for a patch you get accepted upstream and that stays merged, without reverts, for one month, not for the report. This is a Tier 2 project, in scope through its OSS-Fuzz integration, so $5,000 is the reachable ceiling; the $15,000 headline and the 2× and 3× memory-safety multipliers are Tier 1 only. Awards start at $100, the patch has to be between one and twelve months old, submissions are capped at three per person per month, and one-liner fixes for non-exploitable crashes are not rewarded. Sanctions and territory exclusions apply. CVE history 69 Last 12 months 748 Lifetime Memory safety 45 % Denial of service 30 % Parsing/validation 15 % Info disclosure 8 % Latest advisories Loading the feed Overview Wireshark is the default packet analyser wherever network traffic gets examined: SOCs, incident response, NOCs and protocol development. It ships in every Linux distribution, in Kali and Security Onion, and its wiretap and epan libraries are embedded in third-party analysis products, so the blast radius exceeds the GUI install base. The threat shape is inverted. An analyst deliberately opens a hostile pcap to investigate it, and dumpcap has historically run with elevated capture privileges. With 748 lifetime CVEs and 69 in the last twelve months it has the heaviest stream in its niche, structurally so: every protocol on earth, parsed in C, from untrusted input, with no sandbox. The Wireshark Foundation pays nothing, so sorona.xyz pays you directly on qualified, reproduced findings. In scope The Wireshark security team takes reports at [email protected] and publishes its own advisories alongside a scheduled release. The covered object is the Wireshark tree itself, with no boundary drawn narrower than that The whole dissector corpus in epan/dissectors , roughly three thousand of them, every one parsing fully attacker-controlled bytes The wiretap capture-file library in full, covering pcap, pcapng, ERF, Netscaler, K12 and dozens of vendor formats, which run before any dissector does The command-line tools as well as the GUI, tshark and dumpcap included, and the privileged capture path that historically holds elevated capabilities The epan core itself: the dissection engine, the tvbuff buffer abstraction, and address and value-string handling The extension surface, covering the Lua scripting bindings and the extcap plugin interface, where external code and configuration cross into the dissection engine Out of scope One-liner null-check patches that only fix a non-exploitable dissector crash, which the reward rules place below the bar Denial of service through resource exhaustion, named explicitly in the rules as non-rewardable in the one-liner category Patches younger than one month or older than twelve, which the reward age window excludes at both ends Anything not merged upstream, and anything reverted within the first month after it lands Bugs in third-party build dependencies rather than in the Wireshark tree itself Third-party products that embed wiretap or epan , which are their vendors' problem rather than this project's Most-valued findings Memory corruption in a dissector reachable from a hostile pcap, since the analyst opens the attacker's own bytes in order to investigate them. Memory safety is the largest class here and this is the shape that reaches an incident responder's workstation Heap overflow or use-after-free in the wiretap capture-file readers, which parse the container before any dissector is chosen and therefore need no protocol match to reach Defects in the epan core, meaning the dissection engine, tvbuff and address and value-string handling, because a single fix there covers thousands of dissectors and clears the systemic-hardening bar the one-liner rule sets Anything reachable in dumpcap or the privileged capture path, where an ordinary parsing bug crosses a privilege boundary rather than staying inside the analyst's session Memory-safety problems reached through the Lua bindings or the extcap plugin interface, which analysts routinely load from scripts they did not write Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Send a detailed, reproducible report to [email protected] with the capture file or fuzz case that triggers it Give the Wireshark security team room to ship a fix on its regular release cadence before any public writeup If you also want the Google patch money, land the fix upstream yourself and keep it merged without reverts for one month, with the patch between one and twelve months old. That is a separate pathway with its own rules One-liner patches that fix non-exploitable crashes are not rewarded on the Google side, and that covers most of Wireshark's usual dissector-crash stream unless the fix is a systemic hardening change Google's side is capped at three submissions per person per month, is expressly discretionary, and cannot pay anyone on a sanctions list or resident in Russia or Belarus Disclosure Coordinated with the Wireshark security team through [email protected] . The project publishes its own advisories at wireshark.org/security alongside a scheduled release, and Patch Rewards adds no confidentiality or embargo term of its own, so hold the detail until the fixed release ships. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability