curl plans public handling for low- and medium-severity vulnerability reports

High and critical reports remain private

According to The Register, curl maintainer Daniel Stenberg said the project is changing how it handles vulnerability reports after an overwhelming volume of submissions. Reports assessed below high severity should be filed publicly; researchers uncertain of severity can still submit through HackerOne for assessment. Stenberg said public handling could allow more people to assess reports, develop fixes, prepare advisories and look for related issues, while acknowledging that disclosure before a fix can give attackers more time to exploit a flaw.

The report describes this as a change from handling lower-severity vulnerability reports privately. It does not fully detail the prior filing process for every severity level.

From October 26, curl is reportedly set to direct low- and medium-severity vulnerability reports to its public GitHub repository, while private handling is reserved for high- and critical-severity cases.

The reported policy would alter the disclosure path for lower-severity issues in a widely used open-source data-transfer tool. It explicitly trades some pre-fix confidentiality for broader participation in report assessment and remediation, while retaining private handling for the highest-severity cases.