Swamped curl maintainers take low-level flaws public to survive vulnerability 'avalanche'

Curl's maintainers are exposing low-level vulnerabilities to the public in an effort to manage an overwhelming influx of security reports. From October 26, low and medium-severity issues will be filed openly on GitHub, while high and critical flaws will remain private. This shift is prompted by an avalanche of vulnerability reports received over the past few years, with over 90 percent of them deemed less than HIGH severity.

The maintainer, Daniel Stenberg, has previously shuttered the project's bug bounty scheme due to the overwhelming workload caused by AI-generated submissions. Stenberg acknowledges that the policy change is a survival strategy, as the team is feeling strained and overloaded. Exposing vulnerabilities publicly allows more people to assess and fix issues, write advisories, and detect related problems before releases.

However, this approach also means that attackers will have more time to exploit flaws before fixes are available. Stenberg admits that public disclosure of less severe vulnerabilities is unfortunate but unavoidable, as it helps prevent the problem from becoming unmanageable.