The Apache Software Foundation takes a very active stance in eliminating security problems and denial of service attacks against its products.
We strongly encourage folks to report such problems to our private security mailing list first, before disclosing them in a public forum.
For instructions how to report a security vulnerability, please consult our security guide.