Swamped curl maintainers take low-level flaws public to survive vulnerability ‘avalanche’

The curl project will make low- and medium-severity vulnerability reports public from 26 October, while keeping high and critical cases private. Maintainer Daniel Stenberg says an unrelenting surge of reports is overloading the project’s key maintainers, and the change is intended to spread the work and help curl cope.

More people may be able to assess reports, prepare fixes and advisories, and spot related issues before releases, though public handling will not reduce the work required for each report. It may also give attackers more time to exploit flaws before fixes are ready. Stenberg said more than 90 per cent of submissions in recent years were quickly judged below high severity, and that some AI-assisted reports flag minor discrepancies in unusual combinations unlikely to occur in real applications.