Swamped curl maintainers take low-level flaws public to survive vulnerability 'avalanche'

An "avalanche of vulnerability reports" is forcing curl to move lower-severity cases into public view, reserving private handling for high and critical flaws.

From October 26, low and medium-severity reports should be filed in the open source data transfer tool's public GitHub repository, maintainer Daniel Stenberg said.

"Security researchers in doubt can still submit the issue on HackerOne and we can tell them what severity we deem it to be. Over the last few years, over 90 percent of all submissions could quickly be assessed to be less than HIGH."

Stenberg already shuttered curl's bug bounty scheme this year as AI-generated submissions piled work onto its security team.

Stenberg has previously acknowledged that not all AI-assisted reports are bad, but the workload now demands another response.

"This policy change is entirely triggered by the current avalanche of vulnerability reports that keep pouring in. …