Stalwart Labs bug bounty programs
stalw.art Updated
Stalwart Labs runs two public programs: a Sorona bug bounty paying up to $1,500 and a self-hosted disclosure program with no cash rewards.
- Top reward
- $1,500
- Sorona
- Programs
- 2
- 1 pays cash
- Targets in scope
- 19
- 3 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Stalwart
Sorona · Pays the most of the 2 programs: up to $1,500.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Stalwart
Sorona · Bug bounty |
– | – | – | $100 (highest) | $1,500 | Partial | – | 24 hours promised | Open |
|
Stalwart Labs
Self-hosted · Disclosure only |
– | – | – | – | No cash | Full | – | 24 hours promised | Open |
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100 (highest)
- Safe harbor
- Partial
- First response
- 24 hours promised
-
- Safe harbor
- Full
- First response
- 24 hours promised
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
19 targets across all 2 programs, each listed once with the programs that cover it. 13 excluded.
-
Authentication across every protocol, plus the directory backends behind it: internal, LDAP, SQL and OpenID Connect where configured
Products and areas
Covered by Sorona
-
CalDAV and CardDAV, including recurrence expansion, report handling and the query surface calendar clients drive
Products and areas
Covered by Sorona
-
documentation that, if followed, would lead to an insecure deployment
Products and areas
Covered by Self-hosted
-
JMAP, covering every method the API exposes and the session and push mechanisms attached to it
Products and areas
Covered by Sorona
-
Message and MIME parsing, including nesting depth, encoded content and the decoders running over sender-supplied bodies
Products and areas
Covered by Sorona
-
Spam filtering, DKIM signing and verification, and the sieve scripting engine running against incoming mail
Products and areas
Covered by Sorona
-
Stalwart Mail and Collaboration Server (supported versions)
Products and areas
Covered by Self-hosted
-
The access-control model over mailboxes, calendars and address books, including sharing and delegation between accounts
Products and areas
Covered by Sorona
-
The administrative interface and the management API, together with everything an operator can change from them
Products and areas
Covered by Sorona
-
The IMAP server in full: the command parser, mailbox selection, SEARCH, FETCH and the literal handling underneath them
Products and areas
Covered by Sorona
-
The published policy asks for private reports of vulnerabilities in Stalwart, offers a legal safe harbour for research conducted under it, and draws no boundary narrower than the server itself
Products and areas
Covered by Sorona
-
The SMTP server and the submission endpoint, both of which parse commands from anyone able to reach the port
Products and areas
Covered by Sorona
-
the Stalwart Mail and Collaboration Server, all currently supported versions
Products and areas
Covered by Self-hosted
-
The storage layer and the blob backends, where one account's data has to stay unreachable from another's
Products and areas
Covered by Sorona
No target matches. Try part of a host name, such as the company name.
Out of scope 13
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
attacks that depend on already-compromised credentials, unless the vulnerability itself enables credential compromise
Self-hosted
-
denial-of-service or volumetric attacks
Self-hosted
-
Findings against versions the project no longer ships, allowing for the fact that the published supported-versions table is out of date
Sorona
-
Operator configuration, including a deployment published without the intended limits or a directory backend deliberately left open
Sorona
-
self-hosted deployments operated by third parties
Self-hosted
-
social engineering of Stalwart staff, customers, or community members
Self-hosted
-
The Docker image build and the host orchestration rather than the server's own code
Sorona
-
The policy publishes no exclusions list, so what follows is ordinary out-of-scope territory rather than a stated policy position
Sorona
-
theoretical findings without a practical exploitation path
Self-hosted
-
third-party integrations, plugins, or forks not maintained by Stalwart Labs
Self-hosted
-
Upstream Rust crates, unless Stalwart's own use of them is what makes the defect reachable
Sorona
-
Volumetric denial of service. A single connection exhausting the process is the interesting case; a flood of connections is not
Sorona
-
vulnerabilities that require physical access to the server hosting Stalwart
Self-hosted
Recent changes
Reward and scope changes across every Stalwart Labs program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Stalwart Labs products, from the NVD.
-
CVE-2026-26312 Medium
Stalwart is a mail and collaboration server. A denial-of-service vulnerability exists in Stalwart Mail Server versions 0.13.0 through 0.15.4 where accessing a specially crafted email containing malformed nested `message/rfc822` MIME parts via IMAP or JMAP causes excessive CPU and memory consumption, potentially leading to an out-of-memory condition and server crash. The malformed structure causes
-
CVE-2026-26312 Medium
Stalwart is a mail and collaboration server. A denial-of-service vulnerability exists in Stalwart Mail Server versions 0.13.0 through 0.15.4 where accessing a specially crafted email containing malformed nested `message/rfc822` MIME parts via IMAP or JMAP causes excessive CPU and memory consumption, potentially leading to an out-of-memory condition and server crash. The malformed structure causes
About this page
This page gathers every public program listed under stalw.art: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.