"We must act to survive," said Daniel Stenberg, the maintainer of curl, summing up a policy change driven by an "avalanche of vulnerability reports" that the project says it can no longer handle behind closed doors.
Daniel Stenberg and the curl maintainers
Faced with what Stenberg calls a never-ending deluge of reports, the curl project is changing how it triages lower-severity security issues. Stenberg, a lead maintainer of the open source data transfer tool curl, described maintainers as "strained, overloaded and brought to the brink of what we can muster." He warned the volume shows no sign of abating and said the project has to adopt measures to preserve its core work.
Public GitHub reporting starts October 26
Beginning October 26, curl will require low and medium-severity vulnerability reports to be filed in the project's public GitHub repository, Stenberg announced. High and critical flaws will continue to be handled privately. The policy shift follows the project's decision earlier this year to close its bug bounty program after AI-generated submissions multiplied the workload for the security team.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleWhy the change: spreading the load and documenting fixes
Stenberg outlined the rationale: public handling is intended to let "more people assess reports, develop fixes, write advisories, and check for related problems before releases ship." He acknowledged the approach "won't reduce the work per report," but argued it could distribute effort across the community and make the resulting lessons and documentation easier to find. Stenberg framed the move as a survival strategy — one the project may revisit if pressures continue.
AI-generated submissions and "unusual option combinations"
Stenberg said a key driver of the avalanche is researchers using AI to generate reports. He described those reports as often containing "unusual option combinations unlikely to occur in real applications, then treating minor discrepancies as vulnerabilities." While he has previously noted that not all AI-assisted reports are bad, the volume and character of many submissions pushed the project to change its handling practices. Over the last few years, Stenberg added, "over 90 percent of all submissions could quickly be assessed to be less than HIGH."
Risk and trade-offs: public disclosure versus private triage
Moving low- and medium-severity reports into the public repository is not without downside. Stenberg conceded that "public disclosure also gives attackers more time to exploit flaws before fixes arrive." To limit that exposure, curl will restrict the public-handling policy to issues it deems "less than HIGH": "We limit this practice to less than HIGH for this reason: at least these problems are not terrible." He emphasized the choice as one born of constrained bandwidth: "We don't have the bandwidth, manpower or even will to handle a never-ending vulnerability reporting stream at this pace."
How researchers, maintainers, and affected users are likely to respond
- Researchers: Those uncertain about severity can still submit reports to HackerOne, Stenberg said, and the project will advise what severity it deems appropriate. Many researchers will now face a visible, public trail for lower-severity findings.
- Maintainers (curl team and contributors): The maintainers expect public filing to broaden who can assess and patch low- and medium-severity issues, spreading the workload that previously landed on a small security team now overwhelmed by volume.
- Affected users and enterprises: Public handling should make advisories, fixes and documentation easier to find — a benefit Stenberg cited — but it also means users will be seeing lower-severity flaws disclosed publicly prior to private mitigation.
Stenberg framed the change as pragmatic and defensive: the project "see[s] no end to them and we do not anticipate this flood to decrease within the next several months." He left the lasting shape of curl's response open — "It might not be our last" — and reiterated the project's immediate goal: "We aim to not drown."
