curl Moves Lower-Severity Security Reports Into the Open as Report Volumes Overwhelm Maintainers

The curl project, the widely used open source data transfer tool, is changing how it handles security reports. From October 26, low and medium-severity cases should be filed in its public GitHub repository, while private handling is reserved for high and critical flaws. Maintainer Daniel Stenberg said researchers who are unsure about severity can still submit through HackerOne, where the team will tell them how it rates the issue. He noted that over the last few years, more than 90 percent of submissions could quickly be assessed as less than high.

Stenberg described the cause as an "avalanche of vulnerability reports" that he does not expect to ease within the next several months. The project had already closed its bug bounty scheme this year as AI-generated submissions added to the workload. He said some AI-assisted reports are useful, but others generate unusual option combinations unlikely to occur in real applications and treat minor discrepancies as vulnerabilities. Public handling will not cut the work per report, but it could let more people assess issues, develop fixes, write advisories and check for related problems before releases ship.

There is a trade-off. Public disclosure gives attackers more time to exploit flaws before fixes arrive. Stenberg accepts this is unfortunate but unavoidable, and limits the practice to lower-severity issues because "at least these problems are not terrible." He said the change may not be the project's last step.