Hot take: curl is moving to full disclosure for LOW and MEDIUM vulnerabilities, only HIGH and CRITICAL will be fixed privately before disclosing them. This is due to the surge of overhyped AI-discovered vulnerabilities that are flooding their bug trackers and drowning the developers.
As bug bounties are going away and we're quickly moving back to a full disclosure process like in the 90ies, I wonder how patch testing and distribution will keep up?
https://daniel.haxx.se/blog/2026/10/20/do-minor-curl-vulnerabilities-in-the-open/
daniel.haxx.seDo minor curl vulnerabilities in the openThe curl project has decided to alter its vulnerability disclosure program procedure and starting October 26 2026, we insist that all vulnerability reports submitted to us that are deemed to be severity LOW or MEDIUM should instead be submitted as issues in our GitHub repository. Only vulnerabilities deemed to be HIGH or CRITICAL will be … Continue reading Do minor curl vulnerabilities in the open