Swamped curl maintainers take low-level flaws public to survive vulnerability 'avalanche'
From October 26, only high and critical cases stay private as project seeks help sharing the workload
A deluge of vulnerability reports is forcing the open-source data transfer tool curl to move lower-severity cases into public view to survive the avalanche. Starting October 26, low and medium-severity reports should be filed in curl's public GitHub repository, according to maintainer Daniel Stenberg. Security researchers can still submit issues on HackerOne, but Stenberg can advise on severity.
Low and medium-severity reports previously went unreported due to the burden on curl's security team. This policy change is a survival strategy, as Stenberg admits that not all AI-generated reports are bad but the workload is immense. Stenberg acknowledges public handling won't reduce work per report but aims to distribute the load and make lessons more accessible.
Public disclosure also allows attackers more time to exploit flaws. However, Stenberg warns that this could give attackers more time to exploit flaws before fixes arrive. Nonetheless, Stenberg believes public handling is a necessary step to prevent the project from drowning in the flood of vulnerability reports.
Written by urgent.news from The Register Science's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
