Apache HTTP Server

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Separately, for a merged upstream patch : up to $15,000 Google Patch Rewards pays for a patch you get accepted upstream and that stays merged, without reverts, for one month, not for the report. httpd is named by repository in the Tier 1 scope table under 'High-profile web and mail servers', and is independently an OSS-Fuzz project, so the full Tier 1 ceiling applies. Patches must be one to twelve months old, a committer has to accept the change, it is rate-limited to three submissions a month, and sanctions and territory exclusions apply. CVE history 29 Last 12 months 351 Lifetime Parsing/validation 30 % Access control 25 % Memory safety 20 % Info disclosure 15 % Latest advisories Loading the feed Overview httpd still fronts a large minority of all websites. It is the default in the LAMP stack, ships in every distribution, runs across cPanel and Plesk hosting fleets, and is embedded in a long tail of enterprise appliances and Java front-ends. Thirty years of install base means old, unpatched deployments are the norm, and its CVEs get exploited in the wild fast: CVE-2021-41773 was a path traversal being used within days. It is also the most CVE-active project in this niche, 351 lifetime and 29 in the last twelve months. The Apache Software Foundation pays nothing for a report sent to [email protected] , so sorona.xyz pays you directly on qualified, reproduced findings. In scope The ASF security team takes reports at [email protected] for a defect in a module shipped in the httpd tree, or in APR and APR-util, on a currently supported release. That is the boundary, and everything below sits inside it The whole request pipeline, from connection handling through mod_http parsing to the response: the request line, headers, chunked and Transfer-Encoding handling, and any framing disagreement between the core and a module that reframes a request mod_proxy in full, with every backend it ships: mod_proxy_http , _ajp , _uwsgi and _fcgi , historically the richest seam in the codebase URL and path handling end to end, covering mod_rewrite , mod_alias and the core's own mapping of a request onto a file mod_ssl and its integration with OpenSSL Authentication and authorisation in full: mod_session , the whole mod_auth* family and the authorisation provider chain Every other module shipped in the httpd tree, since the boundary the ASF draws is the tree rather than a named list of modules APR and APR-util, the portability libraries httpd links against and which carry their own parsing surface Out of scope Third-party modules not shipped in the httpd tree, which belong with whoever wrote them Configuration-only issues where the administrator has explicitly enabled an unsafe directive One-liner fixes for non-exploitable crashes, excluded by name in the Patch Rewards rules Findings in the abandoned 2.2 branch Denial of service that reduces to resource exhaustion proportional to request volume A vulnerability report on its own where the patch money is concerned: that rail pays for a merged fix rather than for the finding Most-valued findings Request smuggling or desync between mod_proxy and the core, or between httpd and a backend, which is the highest-value class here because httpd is so often the front door in front of an application that trusts it Path traversal or source disclosure through mod_rewrite and mod_alias , the CVE-2021-41773 shape, which is trivially weaponised against a thirty-year installed base that patches slowly Authorisation bypass through the mod_auth* provider chain or mod_session that reaches a resource the configuration intended to protect, since access control is 25 percent of the record Memory corruption in a shipped module or in APR reachable from an unauthenticated request, before any authentication has run A structural fix that hardens the whole proxy or path-handling layer rather than one directive, since the top Patch Rewards band pays for changes that almost certainly prevent major vulnerabilities in the affected code Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Send a detailed, reproducible report to [email protected] with the exact request sequence and the configuration it needs; if it cannot be reproduced it is not eligible Show the bug in a module shipped in the httpd tree, or in APR and APR-util, rather than in a third-party module the administrator installed separately Findings against the abandoned 2.2 branch are not eligible, so work against a currently supported release If you also want the Google patch money, land the fix upstream yourself and keep it merged without reverts for one month. That is a separate pathway with its own rules On that pathway, reactive single-vulnerability patches are reviewed case by case, one-liner fixes for non-exploitable crashes are not rewarded, and submissions are capped at three per person per month Google cannot pay anyone on a sanctions list, in a sanctioned territory, or located in Russia or Belarus Disclosure Coordinated with the ASF security team through [email protected] , which runs a documented process and publishes its own advisory with an affected-version table when the fix ships. Patch Rewards adds no confidentiality or embargo clause of its own, so timing is the ASF's call; hold the detail until the advisory is out, because the installed base patches slowly and disclosure ahead of a release is directly exploitable here. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability