curl maintainers shift low-severity flaws to public GitHub to survive report avalanche
Facing an unending flood of submissions, the curl project will handle low and medium issues openly starting October 26, reserving private channels for severe bugs.
Key points
- curl will process low and medium vulnerability reports publicly on GitHub starting October 26.
- High and critical severity issues will continue to be handled through private channels.
- The policy change aims to share the workload after an avalanche of submissions strained maintainers.
curl maintainer Daniel Stenberg announced that the open source data transfer tool will move low and medium-severity vulnerability reports to its public GitHub repository starting October 26. This procedural shift reserves private handling exclusively for high and critical flaws, a move Stenberg described as a necessary survival strategy for the project.
The decision responds to what Stenberg calls an "avalanche of vulnerability reports" that has overwhelmed the team. According to The Register, maintainers feel strained and overloaded, with no expectation that the flood of submissions will decrease in the coming months. The project aims to avoid drowning by changing how it processes incoming security issues.
Context and Background
Stenberg noted that over the last few years, more than 90 percent of all submissions could be quickly assessed as less than high severity. Previously, the project shut down its bug bounty scheme earlier this year after AI-generated submissions piled excessive work onto the security team. While Stenberg has acknowledged that not all AI-assisted reports are negative, the current volume demands a structural change.
The new policy allows security researchers who are uncertain about severity to still submit issues via HackerOne. The curl team can then inform the researcher of the deemed severity. If classified as low or medium, the issue moves to public tracking. This mechanism ensures that potentially severe bugs do not slip into public view prematurely.
Who Is Affected
Public handling of these reports allows a broader community to assess issues, develop fixes, and write advisories before releases ship. Stenberg stated that this approach spreads the load and makes resulting documentation easier to find, though it does not reduce the work required per report. The theory is that shared visibility improves the overall maintenance process.
However, public disclosure gives attackers more time to exploit flaws before fixes arrive. Stenberg agreed this outcome is unfortunate but unavoidable. The project limits this practice to issues rated below high because those problems are not considered terrible in terms of immediate risk. This distinction aims to balance transparency with security for the most critical vulnerabilities.
What should you do?
Security teams monitoring curl should adjust their intake processes to account for public GitHub issues for low and medium severities. Organizations relying on curl should continue to prioritize patching for high and critical vulnerabilities, which remain under private coordination. Monitoring public repositories may provide earlier visibility into potential, lower-impact issues.
What to do and how to stay safe: curl
- Monitor the curl public GitHub repository for newly disclosed low and medium-severity issues.
- Continue to treat high and critical vulnerabilities with immediate private remediation priorities.
- Review internal processes to ensure public disclosures are tracked alongside vendor advisories.
- Verify that your organization's curl versions are updated according to standard release schedules.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
When does the new public reporting policy for curl take effect?
The policy takes effect on October 26, at which point low and medium-severity reports should be filed in the public GitHub repository.
How can researchers submit a vulnerability if they are unsure of its severity?
Researchers can still submit the issue on HackerOne, where the curl team will assess the severity and direct them to the appropriate channel.
Why did curl shut down its bug bounty scheme earlier this year?
The scheme was shuttered because AI-generated submissions piled excessive work onto the security team, contributing to the current overload.
