Curl Moves Low and Medium Vulnerability Reports to Public GitHub Issues From Oct. 26

From Oct. 26, the curl project will no longer take reports it rates LOW or MEDIUM through its private HackerOne channel. They go into public GitHub issues instead, and only HIGH or CRITICAL reports stay private. Daniel Stenberg announced the change on Oct. 20 in a post titled "Do minor curl vulnerabilities in the open".

The attacker's view changes first. Anyone watching curl's issue tracker will see a described flaw before a fix ships, for every report short of HIGH. Stenberg concedes the point: public disclosure gives attackers a "slightly longer window of opportunity" against existing users, and he says no alternative avoids it.

Why the project is doing it

The post says the change is "entirely triggered by the current avalanche of vulnerability reports," and that maintainers feel "strained, overloaded." It adds: "We must act to survive." Stenberg writes that over the last few years, "over 90% of all submissions could quickly be assessed to be less than HIGH." He gives no total report count and no CVE count for 2026.

The curl.se vulnerability table shows what the volume looks like on a single day. Of 24 entries dated Oct. 14, the day curl 8.23.0 shipped, one is HIGH and 23 are LOW. None is MEDIUM.

1. LOW23 CVEs
2. MEDIUM0 CVEs
3. HIGH1 CVEs

Source: curl.se vulnerability table, accessed 2026-10-21

The split matters for the rule. Had it been in force on Oct. 14, 23 of those 24 reports would have been public issues.

Who is sending the reports

Stenberg's Oct. 14 post on the audit by Aisle says AI-powered tooling used by "multiple engineers at Aisle" produced "no less than thirty-five" published curl CVEs over the past year, more than any other group or individual. Aisle's own Oct. 15 announcement, written as it agreed to join Cohere, says its platform found 18 of the 24 CVEs in curl's latest release. That is a vendor-supplied figure.

Counts differ by source. Stenberg's Oct. 7 post announced 22 pending vulnerabilities, while the curl.se table lists 24 dated Oct. 14. The post does not explain the gap.

The new rule also covers the reports the project does not want. Stenberg says he will "deny and decline" more reports that do not affect real users, especially AI-found edge cases unlikely to occur in practice, rather than dismissing all LOW issues. His reason is that a CVE appeal could lead other parties to assign CVEs to real flaws.

What reporters and users should do

Reporters unsure of severity can still use HackerOne, and the project will state the severity it assigns. A report judged LOW or MEDIUM there will be closed as informative and publicly disclosed, and the reporter asked to resubmit on GitHub.

The main objection, that someone will file a HIGH flaw as LOW in public, gets a short answer. Stenberg calls a flaw filed below its true severity "basically unheard of." The post calls itself one step in a survival strategy that "might not be our last."

For users, the practical consequence is to watch the curl GitHub issue tracker after Oct. 26 as well as the advisory page. The same pressure shows elsewhere: Cloudflare's security-audit skill is another AI-driven audit tool aimed at finding bugs, and a Tor operator's report of 333 exit relays redirecting SSH logins is a recent security story from the same desk.