Skip to Main Content
ApacheCon 2021 Coming Soon! The Apache Software Foundation
Apache 20th Anniversary Logo

Community-led development "The Apache Way"

Apache Support Logo

The Apache Security Team

The Apache Security Team provides help and advice to Apache projects on security issues and coordinates the handling of security vulnerabilities.

Reporting a vulnerability

We strongly encourage you to report potential security vulnerabilities to one of our private security mailing lists first, before disclosing them in a public forum.

A list of security contacts for Apache projects is available. If you can't find a project-specific security e-mail address and you have an undisclosed security vulnerability to report, use the general security address below.

Only use the security contacts to report undisclosed security vulnerabilities in Apache projects and manage the process of fixing such vulnerabilities. We cannot accept regular bug reports or other security-related queries at these addresses. We will ignore mail sent to these addresses that does not relate to an undisclosed security problem in an Apache project.

Also note that the security team handles vulnerabilities in Apache projects, not running ASF services. Send reports of vulnerabilities in ASF services to root@apache.org.

The general security mailing list address is: security@apache.org. This is a private mailing list.

Please send one plain-text email for each vulnerability you are reporting. We may ask you to resubmit your report if you send it as an image, movie, HTML, or PDF attachment when you could as easily describe it with plain text.

You do not need to encrypt submissions, and it takes us longer to respond to encrypted reports. There is no team key for security@apache.org; instead you can use the OpenPGP keys of the following subset of members of the Apache Security Team. Note that this is not a complete list of Apache Security Team members and that you should not contact these members individually about security issues.

You can obtain these public keys in a single file.

Vulnerability Information

You can usually find information on known vulnerabilities for an Apache project on the project's web pages. For convenience, consult the list of security information pages for Apache projects. If you can't find the information you are looking for on the project's web site, ask your question on the project's users mailing list. Don not ask the security contacts directly about about:

The relevant project's users list is the place to ask such questions. The Apache Security Team and any project security team will ignore any such questions you send directly to them.

Vulnerability handling

An overview of the vulnerability handling process is:

Committers should read a more detailed description of the process. Reporters of security vulnerabilities may also find it useful.