Swamped curl Maintainers Take Low-Level Flaws Public to Survive Vulnerability 'Avalanche'
The Register, Tuesday, October 20th, 2026
From October 26, curl will handle low and medium severity reports publicly on GitHub, keeping only high and critical issues private.
Facing an avalanche of vulnerability reports, many AI-assisted, curl maintainer Daniel Stenberg said low and medium severity issues should be filed in the project's public GitHub repository from October 26, with only high and critical reports handled privately.
He said over 90% of submissions in recent years were quickly judged below high severity.
The project already ended its bug bounty this year.
Stenberg described maintainers as strained and overloaded and called the change a survival step, arguing public handling lets more people help assess, fix and document reports.