Key points
- Low and medium severity reports for curl move to public GitHub starting October 26.
- High and critical vulnerabilities remain handled privately by the security team.
- No specific patch is mentioned; this is a change in reporting policy for incoming issues.
The curl data transfer tool is changing how it handles security reports. Starting October 26, issues rated low or medium severity will be filed in the project's public GitHub repository. Only high and critical flaws will remain private, according to maintainer Daniel Stenberg. This shift aims to distribute the workload of reviewing submissions.
In plain English
Curl is an open source tool used to transfer data with URLs. It is widely embedded in operating systems and applications. The project is receiving too many vulnerability reports to handle privately. By making lower-severity reports public, the team hopes other developers can help assess and fix them. This does not mean a new software version is released today.
The background
The change follows an "avalanche" of vulnerability reports, many generated by AI tools, according to The Register. Stenberg previously closed curl's bug bounty program this year due to the volume. He stated that over 90 percent of recent submissions were assessed as less than high severity. The team feels strained and overloaded by the constant flow of new issues.
What changes now
Researchers unsure of a flaw's severity can still submit reports via HackerOne for triage, Stenberg said. Public handling allows the community to write advisories and check for related problems before official releases ship. Stenberg admitted this gives attackers more time to exploit flaws, but called it unavoidable to prevent the project from drowning in work.
Who needs to act first
Teams should inventory all systems using curl to understand their exposure. Prioritize updating servers that face the internet or handle sensitive data transfers. Test any new curl versions in isolated environments before rolling them out to production. Back up configurations and application dependencies to ensure a quick rollback if updates cause compatibility issues. Monitor public GitHub issues for emerging low-severity flaws that may require immediate mitigation.
Background: Bug bounty programs
Bug bounty programs are not open-ended penetration tests. They operate within strict technical scopes and legal boundaries. Participants often fail by testing out-of-scope assets, duplicating known issues, or ignoring disclosure policies. Success requires precise adherence to program rules and a focus on novel, high-impact vulnerabilities rather than volume.
Read the full guide: Bug Bounties: 6 Common Misunderstandings That Cost Researchers
What to do and how to stay safe: curl
- Check which version of curl your servers and applications are currently running.
- Subscribe to the public GitHub repository to track new low-severity vulnerability reports.
- Review network logs for unusual data transfer activity that might indicate exploitation.
- Wait for the vendor to provide an official update before applying fixes to critical systems.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this mean curl has a new critical vulnerability?
No, the source material describes a policy change for handling reports, not a specific new critical flaw.
When do low-severity reports become public?
From October 26, low and medium-severity reports should be filed in the public GitHub repository.
Are high-severity reports still private?
Yes, only high and critical cases stay private as the project seeks help sharing the workload.
