- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 12
- Public CVEs
- 1
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 1 day
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Response
-
Within 1 days
The policy commits to acknowledging inside 24 hours and targets 90 days to a fix, a firmer timeline than anything else in this category
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
12 assets you may test, 6 excluded.
Web 1
- https://stalw.art
Products and areas 11
- Authentication across every protocol, plus the directory backends behind it: internal, LDAP, SQL and OpenID Connect where configured
- CalDAV and CardDAV, including recurrence expansion, report handling and the query surface calendar clients drive
- JMAP, covering every method the API exposes and the session and push mechanisms attached to it
- Message and MIME parsing, including nesting depth, encoded content and the decoders running over sender-supplied bodies
- Spam filtering, DKIM signing and verification, and the sieve scripting engine running against incoming mail
- The access-control model over mailboxes, calendars and address books, including sharing and delegation between accounts
- The administrative interface and the management API, together with everything an operator can change from them
- The IMAP server in full: the command parser, mailbox selection, SEARCH, FETCH and the literal handling underneath them
- The published policy asks for private reports of vulnerabilities in Stalwart, offers a legal safe harbour for research conducted under it, and draws no boundary narrower than the server itself
- The SMTP server and the submission endpoint, both of which parse commands from anyone able to reach the port
- The storage layer and the blob backends, where one account's data has to stay unreachable from another's
Out of scope (6)
- Findings against versions the project no longer ships, allowing for the fact that the published supported-versions table is out of date
- Operator configuration, including a deployment published without the intended limits or a directory backend deliberately left open
- The Docker image build and the host orchestration rather than the server's own code
- The policy publishes no exclusions list, so what follows is ordinary out-of-scope territory rather than a stated policy position
- Upstream Rust crates, unless Stalwart's own use of them is what makes the defect reachable
- Volumetric denial of service. A single connection exhausting the process is the interesting case; a flood of connections is not
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Submit through sorona.xyz.
-
Email the address on the policy page . It is the preferred channel in SECURITY.md, the contact in the project's security.txt, and the only one that actually works
-
Do not reach for the GitHub advisory route.
-
Test against the current 0.16.x line.
-
Hold the detail until the advisory is out.
Not accepted
-
Volumetric denial of service. A single connection exhausting the process is the interesting case; a flood of connections is not
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 9 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-26312 | Stalwart is a mail and collaboration server. A denial-of-service vulnerability exists in Stalwart Mail Server versions 0.13.0 through 0.15.4 where accessing a specially crafted email containing malformed nested `message/rfc822` MIME parts via IMAP or JMAP causes excessive CPU and memory consumption, potentially leading to an out-of-memory condition and server crash. The malformed structure causes | Medium 6.5 | 19 Feb 2026 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 3 Last 12 months Denial of service 50 % Parsing/validation 25 % Auth bypass 15 % Access control 10 % Latest advisories Loading the feed Overview Stalwart is a mail server written in Rust that does the whole job in one process: SMTP, IMAP, JMAP and CalDAV/CardDAV. It is the fastest-growing project in this category, with roughly 1.4 million Docker pulls and a release most weeks, and every one of those protocols listens for connections from anyone who can reach the host. All three advisories from the past year sit in the same place, memory exhaustion in a parser reachable before or barely after authentication, with CVE-2025-61600 rated 7.5. The project states in writing that it runs no paid bounty, so sorona.xyz pays you directly on qualified, reproduced findings. In scope The published policy asks for private reports of vulnerabilities in Stalwart, offers a legal safe harbour for research conducted under it, and draws no boundary narrower than the server itself The SMTP server and the submission endpoint, both of which parse commands from anyone able to reach the port The IMAP server in full: the command parser, mailbox selection, SEARCH, FETCH and the literal handling underneath them JMAP, covering every method the API exposes and the session and push mechanisms attached to it CalDAV and CardDAV, including recurrence expansion, report handling and the query surface calendar clients drive Message and MIME parsing, including nesting depth, encoded content and the decoders running over sender-supplied bodies Authentication across every protocol, plus the directory backends behind it: internal, LDAP, SQL and OpenID Connect where configured The access-control model over mailboxes, calendars and address books, including sharing and delegation between accounts The administrative interface and the management API, together with everything an operator can change from them Spam filtering, DKIM signing and verification, and the sieve scripting engine running against incoming mail The storage layer and the blob backends, where one account's data has to stay unreachable from another's Out of scope The policy publishes no exclusions list, so what follows is ordinary out-of-scope territory rather than a stated policy position Upstream Rust crates, unless Stalwart's own use of them is what makes the defect reachable Operator configuration, including a deployment published without the intended limits or a directory backend deliberately left open The Docker image build and the host orchestration rather than the server's own code Volumetric denial of service. A single connection exhausting the process is the interesting case; a flood of connections is not Findings against versions the project no longer ships, allowing for the fact that the published supported-versions table is out of date Most-valued findings Resource exhaustion a single connection can trigger before or barely after authentication. All three of the past year's advisories sit here, across nested MIME parsing, the IMAP parser and CalDAV expansion, and CVE-2025-61600 was rated 7.5 for it Anything turning one of those parser defects into memory corruption or code execution rather than a stall. This is a Rust codebase, so the interesting failures live in the logic and in whatever unsafe blocks exist rather than in ordinary buffer handling Pre-authentication reach on any of the four protocol front ends, since a single process serves SMTP, IMAP, JMAP and CalDAV and taking it down takes all of them down at once Authentication bypass across protocols, particularly where JMAP and IMAP disagree about who a session belongs to Cross-account access through the sharing and delegation model, where one user reaches another's mail, calendar or contacts Sieve script handling, where a script runs against every incoming message and the engine is embedded in the same process as everything else Anything reaching the storage or blob backend directly, since that is where every account's data sits together Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Email [email protected] . It is the preferred channel in SECURITY.md, the contact in the project's security.txt, and the only one that actually works Do not reach for the GitHub advisory route. Both published documents name it, and private vulnerability reporting on stalwartlabs/stalwart is switched off [email protected] is the documented backup if the security address has not answered inside 48 hours The policy commits to acknowledging inside 24 hours and targets 90 days to a fix, a firmer timeline than anything else in this category The safe harbour is written down: the project states it will not initiate legal action against a researcher following the policy Test against the current 0.16.x line. The supported-versions table in SECURITY.md is stale and still tops out at 0.15.x, so read it as an oversight rather than a scope limit There is no payment to negotiate. The project may send merchandise for notable contributions and states plainly that it operates no paid bounty Disclosure Coordinated by email with Stalwart Labs against a 24-hour acknowledgement commitment and a 90-day resolution target, then published as a GitHub Security Advisory alongside a release. Releases land roughly weekly, so a fix ships quickly once it is written. The published safe harbour covers research conducted under the policy. Hold the detail until the advisory is out. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability