# Curl Maintainers Shift Low-Severity Vulnerabilities to Public GitHub Repository Project leaders move to public disclosure to mitigate overwhelming AI-generated security report volume. - **Source:** [www.theregister.com - Articles](https://www.theregister.com) - **Published:** 2026-10-20 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/97d5af57-9ebe-4ecf-a4c4-a21e062a3a60 ## Shift to Public Disclosure Starting October 26, curl will transition low and medium-severity vulnerability reports to its public GitHub repository. This policy change aims to alleviate the immense pressure on core maintainers who are currently struggling to process an unprecedented volume of incoming security submissions. High and critical flaws will remain handled through private channels. ## The AI Submission Surge Maintainer Daniel Stenberg attributes the current crisis to a massive influx of AI-generated reports. These submissions often highlight unusual option combinations that are unlikely to manifest in real-world applications. The team previously shuttered their bug bounty program earlier this year, yet the relentless stream of reports continues to strain project resources. ## Operational Survival Strategy Stenberg describes this move as a survival strategy to prevent the project from drowning under administrative tasks. With over 90 percent of submissions classified as less than high severity, the team lacks the bandwidth to maintain private handling. They anticipate this high-volume deluge will persist for several months without any immediate decline. ## Crowdsourcing Security Analysis By moving reports to the public domain, the project hopes to distribute the workload among a wider community. Public handling allows more contributors to assess issues, develop necessary fixes, and write advisories. This collaborative approach is intended to help the team manage the workload while ensuring that documentation remains accessible to everyone. ## Risk of Public Exposure Stenberg acknowledges that public disclosure carries inherent risks, specifically granting attackers more time to exploit flaws before patches are finalized. However, he maintains that this trade-off is unavoidable given the current resource constraints. The project limits this practice strictly to non-critical issues to ensure that only lower-risk vulnerabilities are exposed. ## Maintainer Burnout Reality The core maintainers report feeling strained and overloaded, reaching the absolute limit of their capacity. Stenberg emphasizes that the project cannot continue down this spiraling path while maintaining sanity. The current pace of reporting is unsustainable for a project of this size, forcing a fundamental change in how they manage security. ## Filtering Through HackerOne Security researchers who remain uncertain about the severity of their findings can still submit reports via HackerOne. The maintainers will then evaluate the submission to determine if it meets the threshold for private handling or if it must be moved to the public repository. This provides a necessary filter for the team. ## Broader Industry Implications Stenberg believes that few software projects possess the manpower to withstand such a prolonged, high-volume deluge of vulnerability reports. This shift represents a significant change in open-source security management, highlighting the challenges posed by automated reporting tools. The project is prepared to take further steps if this strategy does not suffice. ## Sources covering this story - https://www.theregister.com/security/2026/10/20/swamped-curl-maintainers-take-low-level-flaws-public-to-survive-vulnerability-avalanche/5304198 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._