A Shift in Security Strategy: The curl Project Changes Vulnerability Disclosure Procedures

Introduction

The curl project, a cornerstone of global internet infrastructure, is officially altering its approach to vulnerability management. As of October 26, 2026, the project is implementing a significant shift in its Vulnerability Disclosure Program (VDP). Under the new policy, security vulnerabilities categorized as "low" or "medium" severity will no longer be handled through private, exclusive channels like HackerOne. Instead, researchers will be required to submit these reports directly via the project’s public GitHub repository. Only those vulnerabilities deemed "high" or "critical" will continue to be managed privately within the HackerOne tracker. This pivot represents a major milestone in the evolution of open-source maintenance, reflecting the mounting pressures faced by maintainers in an era of automated, AI-driven security research.

Chronology: The Road to the Policy Shift

For years, the curl project—maintained by Daniel Stenberg—has been a gold standard for transparency and security in open-source software. However, the sheer volume of incoming security reports has become unsustainable.

• Pre-2024: The project maintained a manageable flow of security reports, primarily from human researchers conducting manual audits.
• 2024–2025: The rise of sophisticated AI models and automated fuzzing tools began to flood the project with reports. These reports often focused on obscure edge cases, unlikely command combinations, and protocol discrepancies that had little impact on real-world security.
• May 2026: Stenberg noted that while AI models were increasing in frequency, their output was often "noise." A notable example occurred when an AI model identified only one minor, low-severity vulnerability, highlighting the discrepancy between AI capability and actual threat mitigation.
• October 20, 2026: Daniel Stenberg formally announced the upcoming change to the disclosure policy on the official curl blog, citing unsustainable workload and a need for community collaboration to handle the "avalanche" of reports.
• October 26, 2026: The official date for the implementation of the new disclosure procedures.

Supporting Data: The "Avalanche" of Reports

The driving force behind this change is a simple, harsh reality: the human cost of maintaining software that powers everything from smart fridges to global banking systems. According to project statistics, over 90 percent of all incoming vulnerability reports in recent years have been classified as "low" or "medium" severity.

The project has reached a breaking point. The developers, already stretched thin, are struggling to process a non-stop influx of reports, many of which involve highly technical but practically irrelevant sequences of operations. The complexity of libcurl—with its vast array of protocols, configuration options, and flexible API—provides an almost infinite "playground" for automated tools. AI models are consistently finding "discrepancies" that technically deviate from perfect documentation but rarely manifest as exploitable security risks in a production environment.

For the maintainers, the "CVE dance"—the bureaucratic process of verifying, documenting, and publishing Common Vulnerabilities and Exposures (CVEs) for every minor finding—is consuming time that could be better spent on architectural improvements or high-priority security patches.

Official Responses and Rationale

In his announcement, Daniel Stenberg was candid about the project’s exhaustion. He emphasized that the move to public reporting on GitHub is not a retreat, but a strategic delegation.

Why Public Disclosure?

The core philosophy behind the shift is that "publicity breeds help." By moving the discussion to GitHub, the project hopes to:

1. Distribute the Workload: By making reports public, other community members can assist in verifying, reproducing, and fixing issues.
2. Encourage Holistic Fixes: When vulnerabilities are handled in the open, researchers and contributors can spot related issues. This allows the team to fix not just the reported bug, but the underlying systemic weakness, preventing future, similar vulnerabilities.
3. Speed Up Distribution Response: When vulnerabilities are public from the start, downstream users and operating system distributions can begin working on patches immediately, rather than waiting for the formal end of a private disclosure cycle.

Addressing Concerns Regarding "Risk"

Some have raised concerns that malicious actors could exploit the public nature of these reports before a fix is available. Stenberg dismisses this as a manageable risk, noting that the policy specifically targets low and medium-severity issues—the types of bugs that are rarely the primary targets of sophisticated, high-impact cyberattacks.

Furthermore, Stenberg argued that the risk of researchers misclassifying a high-risk bug as "low" is negligible. The security research community is highly skilled at identifying genuine danger; if a researcher truly believes a bug is critical, the team remains open to direct contact. However, the "default" for everything else is now public.

Implications for the Security Landscape

The decision by the curl project sends shockwaves through the cybersecurity industry, signaling a potential trend for other critical open-source projects.

The AI-Driven Security Paradox

The rise of AI has created a "vulnerability paradox." While AI is a powerful tool for finding bugs, the speed at which it can generate reports is outpacing the human capacity to triage them. If an AI can generate 1,000 "vulnerabilities" in an hour, but humans can only process 10 in a day, the system breaks. By shifting to a public model, curl is effectively forcing the AI-security ecosystem to become more efficient, demanding that researchers provide better, more contextual analysis if they want their reports to be prioritized.

Changing the Relationship with Researchers

Historically, vulnerability disclosure has been a private, "hush-hush" affair between researchers and maintainers. The move to GitHub represents a shift toward "Open Source Security Operations." It assumes that the community is a defensive asset. However, it also places a burden on researchers to be more collaborative. If a researcher submits a report to GitHub, they are now part of a public dialogue, not just a silent informant.

Implications for Downstream Users

For users of curl, this change is largely positive. Security patches for minor issues will be visible earlier, allowing enterprise IT departments and Linux distribution maintainers to track issues in real-time. The "black box" of vulnerability management is being opened, which generally leads to better overall software quality and a more resilient ecosystem.

Conclusion: A Necessary Evolution

The curl project’s decision is a pragmatic response to the realities of modern software maintenance. It acknowledges that the current model of private, manual triage is failing under the weight of AI-assisted discovery. By moving low- and medium-severity issues into the public domain, the project is attempting to reclaim its resources, encourage community participation, and focus its limited human energy on the vulnerabilities that actually matter.

Whether this model will be adopted by other critical open-source projects remains to be seen. However, as the gap between automated bug discovery and human patch development continues to widen, the curl project’s move may well become the new industry standard. The project is effectively saying: "We cannot fix the entire internet alone; if you want to help, bring your tools and join the public effort." It is a bold, transparent, and perhaps necessary step toward ensuring the long-term health of one of the world’s most vital software libraries.