The curl project will switch to publicly handling low and medium-severity vulnerability reports from October 26, as maintainers face an "avalanche" of submissions that senior developer Daniel Stenberg says is pushing the team to its limits. The change, reported by The Register, is part of a survival strategy for the team that keeps the widely-used data transfer tool secure.
The curl project, which provides the command line tool and libcurl library for transferring data, currently handles vulnerability reports privately through HackerOne. But maintainers are overwhelmed by a surge in submissions, many of them AI-generated.
"Over the last few years, over 90 percent of all submissions could quickly be assessed to be less than HIGH," Stenberg said. From October 26, reports assessed as low or medium severity will be filed in curl's public GitHub repository, opening the work of assessing, fixing and documenting them to the community.
Stenberg acknowledged that public disclosure gives attackers a head start on exploiting flaws, but argued the move is necessary. "We limit this practice to less than HIGH for this reason: at least these problems are not terrible." The team already shut down curl's bug bounty program this year due to the AI-generated report deluge.
The move is not expected to reduce the work per report, but it could spread the load across more contributors and make the resulting advisories easier to find. "Security researchers in doubt can still submit the issue on HackerOne and we can tell them what severity we deem it to be," Stenberg said.
Stenberg described the team as "struggling" and "brought to the brink of what we can muster." "We can't continue down this spiraling path with our sanity intact. We don't have the bandwidth, manpower or even will to handle a never-ending vulnerability reporting stream at this pace," he said. The change is described as a survival strategy that may not be the last.
Analysis
Why This Matters
- Curl is one of the most widely used open source tools in the world, embedded in operating systems, web servers, IoT devices, and nearly every programming language's HTTP stack. Changes to its vulnerability handling affect the security of countless products and services.
- The maintainer burnout described here is a bellwether for the broader open source ecosystem. If a project as mature and well-staffed as curl is overwhelmed by AI-generated vulnerability reports, smaller projects are likely even more vulnerable.
- The shift to public disclosure for non-critical flaws could change the risk calculus for anyone responsible for patching curl. Faster information may speed up adoption of fixes but also give attackers more time to develop exploits.
Background
Curl is a command line tool and libcurl library used to transfer data with URLs. It is maintained by Daniel Stenberg, who serves as its lead developer. The project has long followed a policy of private vulnerability reporting through HackerOne, with a bug bounty program to incentivise research. In recent years, the project has been inundated with vulnerability reports, many of them generated with the help of large language models. The maintainers have found that more than 90 per cent turn out to be low or medium severity. Earlier this year, Stenberg shuttered the bug bounty program in response to the volume. The new policy, effective 26 October 2026, is the next step in what Stenberg calls a survival strategy.
Key Perspectives
Maintainers (Daniel Stenberg): The project is at risk of drowning in reports. "We are struggling as a project as all key maintainers feel strained, overloaded and brought to the brink of what we can muster. We must act to survive." Public handling for non-critical flaws is intended to spread the load across more community members and make the resulting fixes and documentation easier to find, even if it does not reduce the work per report.
Security researchers and users: Public disclosure for low and medium flaws may speed up the availability of patches and advisories, but it also means attackers can study the flaws before fixes are applied to installations. Stenberg acknowledged this risk but said limiting the practice to less-than-HIGH flaws makes it acceptable. Researchers who are unsure about severity can still check with the project on HackerOne before deciding whether to go public.
Critics/Skeptics: Some in the security community may be concerned that public disclosure of any vulnerability, even low severity, gives attackers a foothold. Others may question whether the policy truly reduces maintainer burden if it merely opens the process to public scrutiny without cutting the total number of reports. Stenberg himself called the approach a theory, noting "it might not be our last" adjustment.
What to Watch
- Whether the shift to public disclosure actually reduces the strain on curl's maintainers or simply shifts it to the public issue tracker, where participants may also become overwhelmed.
- How the security community reacts: will researchers accept the new process or bypass it, potentially submitting high-severity reports publicly if they disagree with the project's assessment.
- The volume of reports in the months after 26 October: if the "avalanche" continues to grow, further policy changes may be needed.
- Whether other widely-used open source projects adopt similar strategies to cope with the AI-generated report wave.
