Postfix

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Separately, for a merged upstream patch : up to $15,000 Google Patch Rewards pays for a patch you get accepted upstream and that stays merged, without reverts, for one month. It does not pay for the report. Postfix sits in Tier 1, where a secure-by-design memory-safety change carries a 2x multiplier until the end of 2026; the figure here is the un-multiplied one. Patches must be between one and twelve months old, the maintainer holds a veto, the panel may split the award with him, and it is rate-limited to three submissions a month. Sanctions and territory exclusions apply. CVE history 7 Last 12 months 43 Lifetime Parsing/validation 35 % Memory safety 25 % Auth bypass 20 % Info disclosure 15 % Latest advisories Loading the feed Overview Postfix is the default mail transfer agent of Debian and Ubuntu and the most widely deployed MTA on the public internet, sitting under a very large share of every Linux server that sends mail at all. It is also the SMTP layer inside almost every self-hosted mail distribution: Mailcow, Mailu, iRedMail, Modoboa and Mail-in-a-Box all ship it, so one Postfix defect propagates through that whole ecosystem at once. The daemon parses envelopes and headers from unauthenticated peers, and the historic strip_address() heap corruption on a non-null-terminated string is the shape that costs most. The project pays nothing for a report, so sorona.xyz pays you directly on qualified, reproduced findings. In scope Reports go to the Postfix maintainer through the project's security contact, against the canonical tarball release from postfix.org. Everything shipped in that release sits inside the boundary The SMTP server in full: the command path, the header and envelope parsers, and everything smtpd reads from a peer before and after authentication The SMTP client and the delivery agents in full, which parse whatever a remote server or a local transport hands back The integer arithmetic throughout that SMTP and header handling, where a length or offset computation wraps and a later buffer operation trusts the result Privilege separation across Postfix's multi-process architecture, where one unprivileged component reaches state or authority the design meant to keep from it The queue manager and the queue files themselves, including races that let a message be delivered, rewritten, duplicated or dropped in a way the operator never configured Authentication and relay control end to end, where a peer gets Postfix to accept, relay or attribute mail it should have refused Safe-buffer or Rust migration of the untrusted-input parsing paths, which is the shape of change the Rewards Panel scores in its top band Out of scope A vulnerability report on its own where the patch money is concerned: that rail pays only on a change merged upstream that then survives a month without reverts One-liner patches that fix non-exploitable crashes, which the rules put verbatim as including crashes that can result from resource exhaustion or denial of service Patches older than twelve months or newer than one month at the moment of submission, and anything past three submissions per person per month Anything the maintainer declines, and Google states plainly that it will not intervene: it is up to the maintainers to decide whether or not to accept your patch Non-security work, meaning features, performance and documentation, which has no security argument to score Misconfiguration in somebody's Postfix deployment rather than a defect in the shipped code Most-valued findings A secure-by-design memory-safety improvement across the SMTP and header parsers, which is the only work carrying the Tier 1 2x multiplier and the highest-value class here until that multiplier expires at the end of 2026 Remote, unauthenticated memory corruption reachable during an SMTP conversation before any authentication completes, which is the worst shape a Postfix bug can take and the one that has historically been mass-exploited. The historic strip_address() and printable() heap corruption on a non-null-terminated string is exactly this shape, and memory safety is a quarter of the record A structural fix that closes an entire family of parser defects rather than one call site, since parsing and validation is the largest class here at 35 percent and the top reward band is explicitly for changes that almost certainly prevent major vulnerabilities in the affected code Privilege-separation hardening across the multi-process architecture, a named qualifying category that permanently limits the blast radius of every future parser bug Relay or authentication-control bypass that gets Postfix to accept mail it should have refused, 20 percent of the record, which lands simultaneously in Mailcow, Mailu, iRedMail, Modoboa and Mail-in-a-Box because all of them ship Postfix as their SMTP layer Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Send a detailed, reproducible report; if we can't reproduce it, it isn't eligible Give the Postfix maintainer room to ship a fix before any public writeup The canonical source is the tarball release from postfix.org rather than a GitHub fork; github.com/vdukhovni/postfix is the maintained public mirror, so land a change with the maintainer rather than assuming a pull request is the route Findings that live in a bundled or linked dependency belong upstream with that project rather than here If you also want the Google patch money, land the fix upstream yourself and keep it merged without reverts for a month; that is a separate pathway with its own one-to-twelve-month age window and a cap of three submissions a month Disclosure Coordinated with the Postfix maintainer through the project's security contact. Routing works here: the Patch Rewards rules contain no confidentiality, embargo or third-party clause, only sanctions and territory limits, and the patch money is claimed on a change that is public by the time you claim it. Hold the detail until a fixed release has shipped, and expect the fix to arrive as a point release rather than on a fixed clock. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability