Stalwart Labs
By Stalwart Labs Ltd Vulnerability disclosure program on Self-hosted stalw.art
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 8
- Public CVEs
- 1
- Last change
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 1 day
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Pays cash
-
No
We do not currently operate a paid bug bounty programme, and we are not affiliated with any third-party bounty platform.
- Response
-
Within 1 days
Initial acknowledgement: within twenty-four (24) hours of receipt.
- Safe harbor
-
Full
Not initiate or support legal action against you in connection with your research;
- Hall of fame
-
Yes
Hall of fame : significant contributions may be listed in our security acknowledgements.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
8 assets you may test, 7 excluded.
Domains 3
- license.stalw.art
- stalw.art
- support.stalw.art
Products and areas 5
- documentation that, if followed, would lead to an insecure deployment
- Official Stalwart Docker images
- Stalwart Mail and Collaboration Server (supported versions)
- the official Docker images published by Stalwart Labs
- the Stalwart Mail and Collaboration Server, all currently supported versions
Out of scope (7)
- attacks that depend on already-compromised credentials, unless the vulnerability itself enables credential compromise
- denial-of-service or volumetric attacks
- self-hosted deployments operated by third parties
- social engineering of Stalwart staff, customers, or community members
- theoretical findings without a practical exploitation path
- third-party integrations, plugins, or forks not maintained by Stalwart Labs
- vulnerabilities that require physical access to the server hosting Stalwart
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Stalwart Labs's policy.
While testing
-
Test only against your own Stalwart installation, or against a deployment operated by Stalwart Labs and explicitly designated as in scope.
-
Do not test against installations operated by third parties without the operator’s authorisation.
-
Not access, modify, exfiltrate, or destroy data belonging to Stalwart Labs or to any third party.
-
Not degrade the availability of the Services. No volumetric, brute-force, or denial-of-service testing.
-
Not publicly disclose the vulnerability before the agreed coordinated-disclosure date.
-
Do not report security vulnerabilities through public GitHub issues, public discussions, the Support Portal, social media, or any other public channel.
Not accepted
-
theoretical findings without a practical exploitation path
-
denial-of-service or volumetric attacks
-
social engineering of Stalwart staff, customers, or community members
-
vulnerabilities that require physical access to the server hosting Stalwart
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope
− stalw.art, − the websites operated by Stalwart Labs Ltd, − license.stalw.art
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-26312 | Stalwart is a mail and collaboration server. A denial-of-service vulnerability exists in Stalwart Mail Server versions 0.13.0 through 0.15.4 where accessing a specially crafted email containing malformed nested `message/rfc822` MIME parts via IMAP or JMAP causes excessive CPU and memory consumption, potentially leading to an out-of-memory condition and server crash. The malformed structure causes | Medium 6.5 | 19 Feb 2026 |