Curl Maintainers Shift to Public Disclosure Amidst AI-Fueled Vulnerability Avalanche
The curl project is moving low and medium severity vulnerability reports to its public GitHub repository to manage an overwhelming influx of submissions, many generated by AI.
The curl project, a ubiquitous open-source tool for transferring data, is implementing a significant policy change in its vulnerability handling process. Facing an "avalanche of vulnerability reports," maintainers are now directing low and medium-severity disclosures to their public GitHub repository, reserving private channels exclusively for high and critical flaws. This strategic shift, effective October 26, 2026, is a direct response to an unsustainable volume of submissions that are straining the project's limited resources.
Maintainer Daniel Stenberg explained that while researchers can still submit issues via HackerOne, the project anticipates that over 90 percent of incoming reports will be classified as less than high severity. This move follows the earlier discontinuation of curl's bug bounty program earlier this year, a decision also influenced by the surge in AI-generated vulnerability reports. While acknowledging that not all AI-assisted reports are without merit, Stenberg emphasized that the current workload necessitates a new approach to preserve the team's capacity.
"This policy change is entirely triggered by the current avalanche of vulnerability reports that keep pouring in," Stenberg stated. "We see no end to them and we do not anticipate this flood to decrease within the next several months." The maintainers describe themselves as "struggling as a project as all key maintainers feel strained, overloaded and brought to the brink of what we can muster." The new strategy is framed as a "survival strategy," with the explicit goal of preventing the project from "drowning" under the pressure.
The rationale behind public disclosure for lower-severity issues is to leverage the broader open-source community. By making these reports public, curl aims to enlist more eyes for assessment, facilitate faster development of fixes, expedite the writing of advisories, and enable more thorough checks for related problems before software releases. This distributed approach, the project hopes, will help spread the workload and improve the accessibility of lessons learned and documentation.
However, Stenberg concedes that public handling does not inherently reduce the effort required per report. A significant drawback is the increased window of opportunity for malicious actors to discover and exploit vulnerabilities before patches are widely deployed. This is a calculated risk, deemed unavoidable given the current circumstances, and is mitigated by limiting the practice to less severe issues.
"We limit this practice to less than HIGH for this reason: at least these problems are not terrible," Stenberg noted. He further elaborated on the nature of AI-generated reports, pointing out that they often involve unusual combinations of options that are unlikely to occur in real-world applications. These discrepancies are then frequently presented as vulnerabilities, adding to the noise and workload.
The maintainers express a clear sense of urgency and the need for self-preservation. "We can't continue down this spiraling path with our sanity intact. We don't have the bandwidth, manpower or even will to handle a never-ending vulnerability reporting stream at this pace," Stenberg concluded. He believes that few software projects are equipped to withstand such a prolonged deluge of reports, underscoring the critical need for innovative solutions in vulnerability management for open-source software.
This situation highlights a growing challenge for open-source projects worldwide: the increasing volume and sophistication of vulnerability submissions, partly driven by advancements in AI. The curl project's response is a pragmatic, albeit potentially risky, attempt to adapt to this new reality and ensure its continued security and stability.