[ Independent security research · Coordinated disclosure ]

Independent security research on critical infrastructure software.

Stella LLC (合同会社Stella) is an independent security research company. Our team audits broadly — from low-level memory corruption in C/C++ infrastructure software, firmware, and cryptographic and network-protocol libraries to web applications — and reports what we find through coordinated disclosure with the vendors who maintain it.

Get in touch →View track record
  • 48 CVEs
  • JPY 17M in bug bounties
  • Team total · 2 members · Oct 2026
  • Coordinated disclosure

[01]

48

CVEs · Team total

Kimura + Oyama · as of Oct 2026

[02]

JPY 17M

Bug Bounty Rewards · Team total

2 members · as of Oct 2026

[Proven Results]

CVEs (48: 38 published, 10 pending disclosure)

These 48 CVEs are the team total. In addition, 5 further reports have been accepted by vendors and are awaiting CVE assignment.

$ stella cves --top
  • CRITCVE-2026-34875·Arm Mbed TLS/PSA Crypto FFDH·CVSS 9.8

    Buffer overflow in FFDH public key export

    psa_export_public_key() fails to verify the caller-provided output buffer is large enough for FFDH public keys, overflowing the buffer during export. Fixed in Mbed TLS 3.6.6 and TF-PSA-Crypto 1.1.0.

    NVDMbed TLS
  • CRITCVE-2026-6665·PostgreSQL/PgBouncer SCRAM·CVSS 9.8

    Stack buffer overflow (CWE-121)

    PgBouncer's SCRAM authentication path assembles the client-final-message with strlcat() but ignores the return value, so a malicious PostgreSQL backend supplying an oversized nonce in server-final-message overflows the on-stack response buffer. Affects PgBouncer prior to 1.25.2.

    PgBouncer changelog
  • HIGHCVE-2026-11940·Python/CPython tarfile·CVSS 7.8

    Extraction filter bypass (CWE-22, CWE-59)

    A crafted archive in which a hardlink references a symlink stored at a deeper path lets tarfile.extractall() with the 'data' or 'tar' filter recreate that symlink at a shallower path, escaping the destination directory. An incomplete fix of CVE-2025-4330.

    CVE
See all itemized CVEs →

[The team]

From memory corruption to web applications.

Stella is a two-person team. Founder Haruto Kimura specializes in memory-corruption vulnerabilities in C/C++ infrastructure software; member Oyama specializes in web application security.

  • Low level: memory corruption in C/C++ infrastructure OSS, firmware, and cryptographic and network-protocol libraries
  • Web: web application security
  • 32 CVEs across TLS, VPN, DNS, routing, proxy, and database infrastructure credited to founder Haruto Kimura, itemized on the Track record page
  • Every finding reported through coordinated disclosure with the project's maintainers

[Coordinated disclosure]

Stella's research is conducted under responsible, vendor-coordinated disclosure. Findings are reported privately to the maintaining vendor and described publicly only after a fix is available or the vendor's embargo ends.

Get in touch.

Questions about our research or a published CVE? Send us a message and we'll get back to you.

Contact us →