Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Postfix bug bounty programs

postfix.org Updated

Postfix runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
9
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Postfix runs.

  • Postfix

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

9 targets. 6 excluded.

  • https://www.postfix.org

    Web

  • Authentication and relay control end to end, where a peer gets Postfix to accept, relay or attribute mail it should have refused

    Products and areas

  • Privilege separation across Postfix's multi-process architecture, where one unprivileged component reaches state or authority the design meant to keep from it

    Products and areas

  • Reports go to the Postfix maintainer through the project's security contact, against the canonical tarball release from postfix.org. Everything shipped in that release sits inside the boundary

    Products and areas

  • Safe-buffer or Rust migration of the untrusted-input parsing paths, which is the shape of change the Rewards Panel scores in its top band

    Products and areas

  • The integer arithmetic throughout that SMTP and header handling, where a length or offset computation wraps and a later buffer operation trusts the result

    Products and areas

  • The queue manager and the queue files themselves, including races that let a message be delivered, rewritten, duplicated or dropped in a way the operator never configured

    Products and areas

  • The SMTP client and the delivery agents in full, which parse whatever a remote server or a local transport hands back

    Products and areas

  • The SMTP server in full: the command path, the header and envelope parsers, and everything smtpd reads from a peer before and after authentication

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • A vulnerability report on its own where the patch money is concerned: that rail pays only on a change merged upstream that then survives a month without reverts

  • Anything the maintainer declines, and Google states plainly that it will not intervene: it is up to the maintainers to decide whether or not to accept your patch

  • Misconfiguration in somebody's Postfix deployment rather than a defect in the shipped code

  • Non-security work, meaning features, performance and documentation, which has no security argument to score

  • One-liner patches that fix non-exploitable crashes, which the rules put verbatim as including crashes that can result from resource exhaustion or denial of service

  • Patches older than twelve months or newer than one month at the moment of submission, and anything past three submissions per person per month

Recent changes

Reward and scope changes across every Postfix program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Postfix products, from the NVD.

Search NVD
  • CVE-2026-43964 Low

    Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced status code that lacks text after the third number.

  • CVE-2023-51764 Medium

    Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs becau

  • CVE-2020-12063 Medium

    A certain Postfix 2.10.1-7 package could allow an attacker to send an email from an arbitrary-looking sender via a homoglyph attack, as demonstrated by the similarity of \xce\xbf to the 'o' character. This is potentially relevant when the /etc/postfix/sender_login feature is used, because a spoofed outbound message that uses a configured sender address is blocked with a "Sender address rejected: n

  • CVE-2017-10140 High

    Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undocumented functionality in Berkeley DB 2.x and later, related to reading settings from DB_CONFIG in the current directory.

  • CVE-2012-0811 Medium

    Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the pw parameter to the pacrypt function, when mysql_encrypt is configured, or (2) unspecified vectors that are used in backup files generated by backup.php.

  • CVE-2011-1720 Medium

    The SMTP server in Postfix before 2.5.13, 2.6.x before 2.6.10, 2.7.x before 2.7.4, and 2.8.x before 2.8.3, when certain Cyrus SASL authentication methods are enabled, does not create a new server handle after client authentication fails, which allows remote attackers to cause a denial of service (heap memory corruption and daemon crash) or possibly execute arbitrary code via an invalid AUTH comman

  • CVE-2011-0411 Medium

    The STARTTLS implementation in Postfix 2.4.x before 2.4.16, 2.5.x before 2.5.12, 2.6.x before 2.6.9, and 2.7.x before 2.7.3 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack.

  • CVE-2009-2939 Medium

    The postfix.postinst script in the Debian GNU/Linux and Ubuntu postfix 2.5.5 package grants the postfix user write access to /var/spool/postfix/pid, which might allow local users to conduct symlink attacks that overwrite arbitrary files.

About this page

This page gathers every public program listed under postfix.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.