Curl moves low and medium vulnerability reports public on October 26
Original title: Swamped curl maintainers take low-level flaws public to survive vulnerability 'avalanche'
High and critical reports stay private; Stenberg says over 90 percent of recent submissions were below high.
Curl maintainer Daniel Stenberg said an avalanche of vulnerability reports is forcing the project to handle lower-severity cases in public. From October 26, low and medium reports should be filed in curl's public GitHub repository, while high and critical cases remain private. Researchers unsure of severity can still use HackerOne. Stenberg said the project closed its bug bounty this year as AI-generated submissions increased the load, and he accepts that public handling gives attackers more time before fixes for issues below high.
Unconfirmed: The volume of reports and the role of AI-generated findings are Stenberg's account.
- He says more than 90 percent of submissions were quickly assessed below high.
- Public handling is meant to spread assessment, fixes, advisories and checks.
- He says work per report will not fall.
- He describes AI-found option combinations unlikely in real applications.
- 1.From October 26, file low and medium curl reports in the public GitHub repository.
- 2.If severity is unclear, submit on HackerOne for the project to assess.
From the original article
2 min read at theregister.comFrom October 26, only high and critical cases stay private as project seeks help sharing the workload
By Paul Kunert · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.