Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Critical Deadlock Vulnerability in Monero RPC Leading to Complete Node ParalysisAnalysed#3307874 | Valid | Denial of Service | Critical | 2026-05-06 | – | 97 |
| RPC service DOSAnalysed#2338094 | Valid | Denial of Service | Medium | 2025-05-23 | – | 47 |
| Dynamic fee algorithm doesn't check for zero feeAnalysed#1981441 | Valid | Denial of Service | Low | 2025-05-23 | – | 46 |
| CryptoNote: remote node DoSAnalysed#506595 | Valid | Denial of Service | High | 2019-07-03 | – | 30 |
| RPC call crashes nodeAnalysed#1379707 | Valid | Denial of Service | High | 2022-08-20 | – | 28 |
| Remote memory exhaustion in Epee RPC stack under zero Receive WindowAnalysed#2912194 | Valid | Denial of Service | High | 2025-04-23 | – | 24 |
| Remote node DOSAnalysed#876530 | Valid | Denial of Service | Medium | 2026-06-29 | – | 24 |
| Monero IPv6 /128 tracking bypasses per-IP limit, enables remote OOMAnalysed#3816330 | Valid | Denial of Service | High | 2026-10-28 | – | 23 |
| Reported Denial of ServiceAnalysed#3241102 | Valid | Denial of Service | – | 2026-04-06 | – | 23 |
| Spamming highly nested JSON RPC requests cause node to disconnect from p2p networkAnalysed#2677306 | Valid | Denial of Service | – | 2025-04-23 | – | 22 |
| Malicious get_random_rct_outs.bin rpc can cause a near-infinite loop#391611 | Valid | Denial of Service | High | 2018-09-28 | – | 12 |
| Excessive Resource Usage#543782 | Valid | Denial of Service | – | 2019-07-03 | – | 9 |
| DoS for remote nodes using Slow Loris attack#416494 | Valid | Denial of Service | Medium | 2019-02-21 | – | 9 |
| Computing hash of crafted block leads to crash in tree_hash()#519120 | Valid | Denial of Service | High | 2019-07-03 | – | 7 |
| monerod JSON RPC server remote DoS#1511843 | Valid | Denial of Service | Medium | 2022-09-12 | – | 5 |
| monerod can be disabled by a well-timed TCP reset packet#363714 | Valid | Denial of Service | Medium | 2018-08-02 | – | 4 |
| epee will accept an arbitrary amount of leading line-breaks in an http request#344499 | Valid | Denial of Service | Low | 2018-08-02 | – | 4 |
| (remote) exabyte allocation via load_from_binary() (DoS)#506498 | Valid | Denial of Service | High | 2019-07-03 | – | 2 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.