Read the advisory on the project's own security page first. If you still need to know whether it applies to your version or configuration, ask on that project's users mailing list. The Apache security team states it will ignore such questions sent to its private security addresses.
How Apache advisories are organised
The Apache Software Foundation security team guides projects and coordinates handling of vulnerabilities. The team is a CVE Numbering Authority covering all Apache projects, and it is the only group able to allocate IDs to Apache project issues. Advisories are published per project, and the foundation keeps a list of security information pages for each project.
That means there is no single Apache feed that fits every need. Each project, such as a web server, a messaging broker or a data tool, keeps its own page and announcement list.
What the private lists are for
The security addresses exist for reporting undisclosed vulnerabilities and managing the fix. The foundation's page lists things you should not ask there, including:
- how to configure the package securely
- whether a published vulnerability applies to your versions
- whether it applies to your configuration
- further information on a published vulnerability
- when patches or new releases will be available
All of those belong on the project's users list. The same page says the security team and project security teams will ignore such questions sent directly to them.
The vulnerability handling flow
The foundation summarises the process in four steps: the reporter reports privately, the project's security team works privately with the reporter, the project creates a release containing the fix, and the project announces the vulnerability publicly with instructions for applying the fix. Knowing this helps you read a notice: the announcement comes after a fixed release exists.
Your steps when an advisory lands
- Find the project's security page from the foundation's list.
- Read affected versions and the fixed version.
- Compare with the version you run. Check transitive copies too, since many Apache libraries arrive indirectly.
- If the advisory depends on a configuration, check your configuration files or settings.
- If the answer is still unclear, search the users list archive, then post a short question with your version and setup.
- Record the outcome, with the link, in your ticket.
| Question | Where it goes |
|---|---|
| I found an undisclosed vulnerability | The private security list |
| Does this advisory affect version X? | The project's users list |
| Is my configuration exposed? | The project's users list |
| When is the fix release? | The project's users list |
| An apache.org website issue | The address the foundation gives for services |
A note on what Apache does not count
The foundation also lists items it does not class as vulnerabilities, such as a missing DMARC or SPF record on its domains, clickjacking on its domains, and version disclosure by its servers. If you hear that "Apache has a vulnerability" in news about those, check the page before reacting.
Where Safeguard fits
Safeguard's SBOM and dependency scanning shows which Apache components and versions are in your software, which gives you the version facts to put in a users list question. Try a free scan at https://gold.safeguard.sh/scan.
Quick check
Can I email security@apache.org to ask if I am affected?
No. That address is for undisclosed vulnerabilities. Applicability questions go to the project's users list.
Is there one advisory feed for all Apache projects?
The foundation says advisories are published per project, with a list of security pages for each.
Sources
- ASF Security Team, fetched 19 October 2026.
Last reviewed: 19 October 2026.
