The curl project announced a major policy change to its vulnerability disclosure program, effective October 26, 2026. LOW and MEDIUM severity vulnerabilities will now be reported and fixed publicly on GitHub, while only HIGH and CRITICAL issues remain private on HackerOne. This shift aims to distribute the burden of vulnerability assessment and fix development across the community.
Background
curl is one of the most widely used HTTP client libraries in the world, critical to the internet infrastructure. The project has been struggling with an overwhelming volume of vulnerability reports that left maintainers near burnout.
- Source
- Lobsters
- Published
- Oct 21, 2026 at 03:47 AM
- Score
- 7.0 / 10