Curl has announced that low and medium severity security reports should be filed publicly via its issue tracker rather than through private vulnerability disclosure, effectively dropping the traditional embargo model for non-critical issues. The author advocates this approach as a way to relieve the overwhelming pressure on open source projects drowning in hundreds of daily CVE reports.
Background
Curl is one of the most widely used open source networking libraries, powering countless applications and systems worldwide. The traditional coordinated vulnerability disclosure (embargo) model has come under increasing scrutiny as the volume of reported vulnerabilities has grown exponentially.
- Source
- Lobsters
- Published
- Nov 8, 2026 at 07:31 AM
- Score
- 7.0 / 10