Eclipse Jetty bug bounty programs

Eclipse Jetty programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
EJ Eclipse Jetty Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• EJ

  Eclipse Jetty

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://jetty.org

  Web

• Reports go to [email protected] against any currently supported branch, and nothing narrower than the Jetty server itself is carved out. The patch pathway attaches to github.com/jetty/jetty.project

  Products and areas

• Request body handling in full: MultiPartFormInputStream, the file-upload parsers, form decoding and the compression handlers

  Products and areas

• Session management, including session identifiers, the clustered and persistent session stores, and the servlet context isolation around them

  Products and areas

• Static content and resource serving as a whole, covering ResourceHandler, DefaultServlet, path resolution, alias checking and the %2e and %2f normalisation logic

  Products and areas

• The HTTP protocol implementation across every version the server speaks: HTTP/1.1, HTTP/2, the HTTP/3 implementation in Jetty 12, and the request-smuggling and desync surface between them

  Products and areas

• The proxy, rewrite and gzip handler modules the project ships, and the connector and buffer layer underneath all of it

  Products and areas

• The security subsystem end to end: the security-constraint matcher, ConstraintSecurityHandler, the authenticators and the login services behind them

  Products and areas

• The servlet container and deployment machinery: context handling, the deployer, JNDI and annotation scanning

  Products and areas

• WebSocket framing and the HTTP upgrade path, both the Jakarta and the native Jetty APIs

  Products and areas

No target matches. Try part of a host name, such as the company name.