curl moves low- and medium-severity vulnerability reports to public GitHub handling from Oct 26 amid AI-driven report flood
The curl project will handle low- and medium-severity vulnerability reports publicly on its GitHub repository from October 26, reserving private handling for high and critical flaws. Maintainer Daniel Stenberg attributes the change to an "avalanche" of vulnerability reports, largely AI-assisted, that has left key maintainers overloaded. The project had already shut down its bug bounty program this year for the same reason. Stenberg acknowledges that public handling gives attackers more time to exploit flaws before fixes ship, but accepts the trade-off because the affected issues are below HIGH severity.
Technical Details
- Researchers who are unsure of severity can still submit via HackerOne, where the team will assess it. Over 90% of submissions in recent years were quickly judged below HIGH.
- Stenberg says AI-using researchers generate unusual option combinations unlikely to occur in real applications and treat minor discrepancies as vulnerabilities.
- Public handling is meant to let more people assess reports, develop fixes, write advisories and check for related problems before releases. It does not reduce the work per report.
- Stenberg expects the flood to continue for several months and says this may not be the last step in the project's "survival strategy".
Remediation
The article gives no specific remediation. Downstream users of curl should monitor the public GitHub repository for low- and medium-severity issues, which will now be visible before fixes are released.
Linha do tempo
-
curl moves low- and medium-severity vulnerability reports to public GitHub handling from Oct 26 amid AI-driven report flood
ler a análise desta fonte ocultar
The curl project will handle low- and medium-severity vulnerability reports publicly on its GitHub repository from October 26, reserving private handling for high and critical flaws. Maintainer Daniel Stenberg attributes the change to an "avalanche" of vulnerability reports, largely AI-assisted, that has left key maintainers overloaded. The project had already shut down its bug bounty program this year for the same reason. Stenberg acknowledges that public handling gives attackers more time to exploit flaws before fixes ship, but accepts the trade-off because the affected issues are below HIGH severity.
Technical Details
- Researchers who are unsure of severity can still submit via HackerOne, where the team will assess it. Over 90% of submissions in recent years were quickly judged below HIGH.
- Stenberg says AI-using researchers generate unusual option combinations unlikely to occur in real applications and treat minor discrepancies as vulnerabilities.
- Public handling is meant to let more people assess reports, develop fixes, write advisories and check for related problems before releases. It does not reduce the work per report.
- Stenberg expects the flood to continue for several months and says this may not be the last step in the project's "survival strategy".
Remediation
The article gives no specific remediation. Downstream users of curl should monitor the public GitHub repository for low- and medium-severity issues, which will now be visible before fixes are released.