Zeek

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Separately, for a merged upstream patch : up to $5,000 Google Patch Rewards pays for a patch you get accepted upstream and that stays merged, without reverts, for one month, not for the report. This is a Tier 2 project, in scope through its OSS-Fuzz integration, so $5,000 is the reachable ceiling; the $15,000 headline and the 2× and 3× memory-safety multipliers are Tier 1 only. Awards start at $100, the patch has to be between one and twelve months old, submissions are capped at three per person per month, and one-liner fixes for non-exploitable crashes are not rewarded. Sanctions and territory exclusions apply. CVE history 2 Last 12 months 4 Lifetime Denial of service 40 % Memory safety 30 % Parsing/validation 20 % Info disclosure 5 % Latest advisories Loading the feed Overview Zeek, formerly Bro, is the network security monitoring backbone of research and government networks, US national laboratories, most universities and many mature enterprise SOCs. It is the engine inside Corelight's sensors, it ships in Security Onion and SELKS, and its logs are the de facto standard network telemetry schema downstream SIEMs consume. It sits passively on a tap and parses everything an attacker can put on the wire, running on the highest-trust box in the environment. Read the four lifetime CVEs carefully: this is a large C++ parser corpus with a scripting interpreter, a history of parser crashes fixed without a CVE, and thin external research attention. The project pays nothing for a report, so sorona.xyz pays you directly on qualified, reproduced findings. In scope Zeek takes security reports at [email protected] under a documented security release process with a bounded embargo. The covered object is the Zeek tree in full, and no boundary narrower than that is drawn The entire analyser corpus under src/analyzer/protocol , plus the SPICY-generated analysers, all of which parse untrusted wire data straight off the tap The Zeek scripting language end to end: the interpreter, its type system, and the script-driven memory management behind it The Broker communication library and the whole cluster control plane between manager, proxies, loggers and workers, where sensor nodes trust each other File analysis and extraction under file_analysis in full, including the MIME and hash pipelines that reassemble transferred content The input framework and every log writer, where attacker-influenced field values reach an output serialiser and then a downstream SIEM Out of scope Zeek package-manager packages authored by third parties, which are not this tree Corelight's commercial sensor software, which embeds Zeek but is a separate product Detection-logic gaps in community scripts rather than defects in the engine itself One-liner non-exploitable crash fixes, which the reward rules place below the bar Patches younger than one month or older than twelve, which the reward age window excludes at both ends Anything not merged upstream, and anything reverted within the first month after it lands Most-valued findings Memory corruption in a protocol or SPICY analyser reachable from traffic an attacker can put on the wire, since the sensor is the highest-trust box in the environment and needs no user to open anything. This is the class that clears the systemic-hardening bar Defects in the scripting interpreter or its type system, which affect every deployment regardless of which analysers are enabled and reach the scripts every site writes Broker or cluster control-plane flaws that let one node influence another, because the trust between manager, proxies, loggers and workers is assumed rather than checked File-analysis and extraction bugs in the MIME and hash pipelines, where reassembled attacker-supplied content is parsed a second time Analyser-driven denial of service that silences the sensor, which is 40% of Zeek's recorded stream and is a detection outage rather than a nuisance, though only a systemic fix clears the reward bar Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Send a detailed, reproducible report to [email protected] with the pcap or script that triggers it Work with the documented Zeek security release process; the embargo is tied to the release schedule rather than left open-ended, and the project offers no money for the report If you also want the Google patch money, land the fix upstream yourself and keep it merged without reverts for one month, with the patch between one and twelve months old. That is a separate pathway with its own rules One-liner fixes for non-exploitable crashes are not rewarded on the Google side, so aim at structural hardening of the analyser or interpreter rather than a single bounds check Google's side is capped at three submissions per person per month and cannot pay anyone on a sanctions list or resident in Russia or Belarus Disclosure Coordinated with the Zeek security team through [email protected] , following the project's published security release process, which runs a bounded embargo tied to the release schedule and carries no third-party bar. Hold the detail until the fixed release ships and the advisory is out. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability