curl project makes minor security flaw reports public to cope with overload

curl, a widely used free tool for moving data over the internet, is changing how it handles security problems. From October 26, reports of low and medium severity flaws will be filed in the open, on the project's public GitHub page. Only high and critical cases stay private. Maintainer Daniel Stenberg says an "avalanche" of reports is the reason.

What changed

Until now, security reports were handled quietly until a fix was ready. Under the new rule, the less serious ones will be discussed in public from the start. Researchers who are unsure how serious a flaw is can still send it through HackerOne, a reporting platform. The curl team will tell them how severe it is judged to be. Stenberg says over 90 percent of submissions in recent years could quickly be rated below high.

Why the project is doing this

The team says it is stretched to the limit. Stenberg wrote that all key maintainers feel "strained, overloaded and brought to the brink," and that the project must "act to survive." curl already ended its bug bounty program this year after AI-generated submissions piled work onto its security team. He has said not all AI-assisted reports are bad. He also says some researchers using AI test odd combinations of settings that real applications are unlikely to use, then report small differences as vulnerabilities.

Public handling will not shrink the work for each report. The hope is that it spreads the load. More people can judge reports, build fixes, write advisories and look for related problems before new versions ship. The lessons and documentation should also be easier to find.

The trade-off

There is a cost. Discussing a flaw in public gives attackers more time to use it before a fix arrives. Stenberg agrees this is unfortunate but unavoidable. That is why the change stops below the high level. In his words, "at least these problems are not terrible."

What to do

Many products rely on free software like curl, so minor flaws may now become visible before fixes exist. Business owners do not need to act on curl directly. A useful step is to ask your IT provider how they track and apply software updates.

What happens next

Stenberg does not expect the flood of reports to ease in the next several months. He describes this as "our next step in a survival strategy" and says it might not be the last.