---
type: "post"
id: "do-minor-curl-vulnerabilities-in-the-open-ca7171"
slug: "do-minor-curl-vulnerabilities-in-the-open-ca7171"
title: "Do minor curl vulnerabilities in the open"
description: "Starting October 26, 2026, curl asks researchers to report vulnerabilities assessed as LOW or MEDIUM through public GitHub issues; only HIGH and CRITICAL reports will remain private on HackerOne."
retrieval_nugget: "Starting October 26, 2026, curl asks researchers to report vulnerabilities assessed as LOW or MEDIUM through public GitHub issues; only HIGH and CRITICAL reports will remain private on HackerOne. The change is a response to a report surge that maintainers say is straining the project, and it trades some disclosure secrecy for broader scrutiny and shared work."
published_at: "2026-11-06"
updated_at: "2026-11-07"
record_date: "2026-11-06"
date_kind: "published_at"
topics: ["github"]
entities: ["curl","libcurl","Daniel Stenberg","HackerOne","GitHub"]
related_patterns: ["agent-security-moves-to-runtime-boundaries"]
novelty_label: "same_event"
prior_refs: []
source_url: "https://daniel.haxx.se/blog/2026/10/20/do-minor-curl-vulnerabilities-in-the-open"
source_urls: ["https://daniel.haxx.se/blog/2026/10/20/do-minor-curl-vulnerabilities-in-the-open"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:do-minor-curl-vulnerabilities-in-the-open-ca7171"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/do-minor-curl-vulnerabilities-in-the-open-ca7171/","markdown":"https://newruntime.com/posts/do-minor-curl-vulnerabilities-in-the-open-ca7171.md","json":"https://newruntime.com/posts/do-minor-curl-vulnerabilities-in-the-open-ca7171.json"}
markdown_url: "https://newruntime.com/posts/do-minor-curl-vulnerabilities-in-the-open-ca7171.md"
---

# Do minor curl vulnerabilities in the open

## Retrieval answer

Starting October 26, 2026, curl asks researchers to report vulnerabilities assessed as LOW or MEDIUM through public GitHub issues; only HIGH and CRITICAL reports will remain private on HackerOne. The change is a response to a report surge that maintainers say is straining the project, and it trades some disclosure secrecy for broader scrutiny and shared work.

## Summary
Starting October 26, 2026, curl asks researchers to report vulnerabilities assessed as LOW or MEDIUM through public GitHub issues; only HIGH and CRITICAL reports will remain private on HackerOne. The change is a response to a report surge that maintainers say is straining the project, and it trades some disclosure secrecy for broader scrutiny and shared work.

## What happened
Daniel Stenberg, writing about the curl project’s vulnerability disclosure process on October 20, said that from October 26, reports deemed LOW or MEDIUM should be submitted as issues in curl’s GitHub repository. Reports assessed as HIGH or CRITICAL will continue to be handled privately in HackerOne. Researchers who are unsure of severity can still submit through HackerOne, where the project can tell them how it classifies the report.

If a report submitted to HackerOne is judged LOW or MEDIUM, the project will ask the researcher to resubmit it on GitHub and close the HackerOne report as informative, with public disclosure. Stenberg said that over the previous few years more than 90% of submissions could quickly be assessed as below HIGH severity. The policy is not a claim that those reports are all invalid: curl’s severity process includes LOW and MEDIUM categories, and Stenberg said genuine vulnerabilities cannot simply be ignored because someone may issue a CVE for them through another route.

The stated reason is workload. Stenberg described a continuing “avalanche” of vulnerability reports, with no expected decline over the next several months, and said key maintainers are strained and overloaded. Public issues, he argues, let more people help assess reports, examine the claimed vulnerability, contribute to advisories, and check whether fixes address the problem or miss adjacent issues. He also expects the public discussions and documentation to be easier for distributions and curl users to follow as fixes develop.

The post connects the volume to researchers using AI models and harnesses to examine recent CVEs and fixes for similar mistakes. Stenberg also described reports based on unusual combinations of libcurl options and protocols that can produce unexpected behavior unlikely to arise in ordinary use. He said he intends to reject more firmly claims that do not harm users or existing applications, rather than perform the full CVE process for every discrepancy.

Stenberg acknowledges a security cost: once a lower-severity issue is public, attackers can see it too, giving them a somewhat longer opportunity to exploit a weakness before users receive a fix. The project’s rationale is that limiting public handling to below-HIGH issues keeps that exposure away from vulnerabilities it considers more serious. The source does not specify a separate timeline for fixes or a mechanism for coordinating them before public disclosure.

## What the archive adds
The archive has a recent, related security story: [Patch the Planet’s dashboard reports 472 accepted patches across 72 codebases](https://newruntime.com/posts/trail-of-bits-patch-the-planet-dashboard-shows-309b83/). That coverage concerns upstream security fixes, not curl’s report triage. This is a new policy change in a related workload-and-remediation thread, rather than a restatement of the dashboard update.

## Trend signal
This weakly connects to [agent security moves to runtime boundaries](https://newruntime.com/patterns/agent-security-moves-to-runtime-boundaries/): the source describes AI-assisted vulnerability discovery and the operational handling of resulting reports, but does not establish that AI agents are part of curl’s security boundary or fix process. It is evidence of changing security-workload conditions, not a direct test of the pattern’s thesis.

## Why now
Stenberg says the volume of vulnerability reports is ongoing, with no expected decrease over the next several months, and that maintainers are already strained. He presents the policy as a survival measure, potentially not the project’s last response to the workload.

## Why it matters
For teams that depend on curl or libcurl, disclosure policy affects when a vulnerability becomes visible and who can help assess it. Public LOW and MEDIUM reports may let users, distributions, and other maintainers follow the reasoning earlier and scrutinize fixes, but they also expose details to potential attackers sooner. The change is especially notable in a context where AI-assisted analysis can produce more candidate findings, including edge cases that may not affect real-world applications.

The practical implication is not that every public report requires an immediate emergency response. Teams should distinguish curl’s severity assessment from their own exposure: check whether a report applies to the versions and configurations they deploy, and follow project advisories and fixes. The post gives no vulnerability list or version-specific remediation guidance, so it cannot support a blanket upgrade instruction. More broadly, it shows how maintainers may alter triage processes when report volume outpaces available review capacity.

## Limits and uncertainty
The post is one maintainer’s explanation of the curl project’s policy, workload, and expected benefits. It does not quantify the number of reports, give a breakdown of AI-generated submissions, or measure how many public contributions will share the assessment burden. It also does not name a specific vulnerability affected by the change, establish that all LOW or MEDIUM reports will receive faster fixes, or specify how quickly public issues will be resolved. The acknowledged disclosure risk is qualitative; the post does not estimate how often attackers exploit such reports.

## Reader takeaway
Curl is moving lower-severity vulnerability reports into public view to make a strained review process more collaborative, while keeping HIGH and CRITICAL reports private. For users, that means earlier visibility may come with earlier exposure; follow curl’s assessments and check applicability rather than treating every report as equally urgent.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Github](https://newruntime.com/topics/github.md): Explore the github topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Sources](https://newruntime.com/sources/): See the original sources this archive cites.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)