Facing what maintainer Daniel Stenberg calls an "avalanche of vulnerability reports," the curl project is changing how it handles lower-severity security issues. According to The Register, from October 26 low and medium severity reports will be filed in the open source data transfer tool's public GitHub repository, while high and critical cases will remain private.
Stenberg says the change is triggered entirely by the current flood of reports, which shows no sign of decreasing. He describes key maintainers as "strained, overloaded and brought to the brink of what we can muster," and calls the policy "our next step in a survival strategy." Public handling will not reduce the work per report, he admits, but it could let more people assess issues, develop fixes, and write advisories before releases ship.
There is a trade-off: public disclosure gives attackers more time to exploit flaws before fixes arrive. Stenberg says the practice is limited to less than HIGH because "at least these problems are not terrible." He also notes that AI-assisted security researchers are generating unusual option combinations unlikely to occur in real applications, and that the project already shut down its bug bounty scheme this year as AI-generated submissions piled on more work.