- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 5
- Public CVEs
- 6
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Replies within 3 days
- As the policy promises.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Response
-
Within 3 days
Our maintainers will attempt to respond to and confirm your report within 2-3 days
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
5 assets you may test.
Domains 2
- almalinux.org
- bugs.almalinux.org
Web 1
- almalinux.org website
Products and areas 2
- AlmaLinux OS
- Elevate
Rules
What the policy asks of you, and the bug types it won't reward, quoted from AlmaLinux's policy.
While testing
-
If appropriate, please include a proof of concept (plaintext only; no binaries)
-
Do Not Send: Sensitive or personal information.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2024-12084 | A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer. | Critical 9.8 | 15 Jan 2025 |
| CVE-2024-12088 | A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory. | Medium 6.5 | 14 Jan 2025 |
| CVE-2024-12085 | A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time. | High 7.5 | 14 Jan 2025 |
| CVE-2024-12086 | A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with in order to determine what data needs to be sent to the server. By sending specially constructed che | Medium 6.1 | 14 Jan 2025 |
| CVE-2024-12087 | A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow | Medium 6.5 | 14 Jan 2025 |
| CVE-2024-6387 | A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period. | High 8.1 | 1 Jul 2024 |