Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Conflux-queued zero-length RELAY_END triggers heap out-of-bounds readAnalysed#3709605	Valid	Memory Corruption	Medium	2026-09-10	–	33
Zip bomb#263663	Informative	Memory Corruption	Critical	2023-11-28	–	14
Use of unitialized value in crypto_pk_num_bits (src/common/crypto.c:971)#274998	Informative	Memory Corruption	–	2023-11-28	–	11
Use-after-free during XML transformations (MFSA-2016-27)#126797	Informative	Memory Corruption	–	2017-10-21	$300	10
solving TOR vulnerability, in other to make bruteforce difficult#268320	Informative	Memory Corruption	Low	2023-11-28	–	9
[tor] libevent dns OOB read#115702	Valid	Memory Corruption	–	2017-10-19	–	7
potential memory corruption in or/buffers.c (particularly on 32 bit)#163459	Valid	Memory Corruption	–	2017-10-19	–	6
Heap corruption via memarea.c#138025	Valid	Memory Corruption	–	2017-10-19	–	6
Overreads/overcopies in torsocks#126598	Valid	Memory Corruption	–	2017-10-19	–	6
libevent (stack) buffer overflow in evutil_parse_sockaddr_port#112784	Valid	Memory Corruption	–	2017-10-19	–	6
[tor] libevent dns remote stack overread vulnerability#112632	Valid	Memory Corruption	–	2017-10-19	–	6
smartlist_add, smartlist_insert (may) cause heap corruption as a result of inadequate checks in smartlist_ensure_capacity#112386	Valid	Memory Corruption	–	2017-10-19	–	6
Use of unitialized value in token_check_object (src/or/parsecommon.c:224)#276255	Duplicate	Memory Corruption	–	2019-10-04	–	3
Use of uninitialized value in networkstatus_parse_vote_from_string (src/or/routerparse.c:3533)#276253	Informative	Memory Corruption	None	2017-10-31	–	2
Use of uninitialized value in memarea_strdup (src/common/memarea.c:369)#274997	Informative	Memory Corruption	–	2017-10-25	–	1
Stack overflow in UnbindFromTree (browser can be crashed remotely)#264481	Informative	Memory Corruption	High	2017-10-02	–	1
Crashes/Buffer at 0x2C0086,name=PBrowser::Msg_Destroy#281682	Informative	Memory Corruption	Medium	2017-10-24	–	–

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.