curl will handle low and medium vulnerability reports in public
Original title: Do minor curl vulnerabilities in the open
From October 26, 2026, only high and critical reports stay private on HackerOne; over 90% of recent submissions were below high.
The curl project will require reports it rates low or medium to be filed as public GitHub issues starting October 26, 2026. Only high and critical reports remain private on HackerOne. Maintainers say the change answers a sustained flood of reports, including AI-generated option combinations with little real-world risk, and that more than 90% of recent submissions were below high. They accept a longer window for lesser flaws in exchange for broader public review.
Unconfirmed: Maintainers call accidental public filing of a high-severity issue a low risk, based on past reporter behavior.
- Unsure reporters can still start on HackerOne and be told the project's severity.
- Low or medium HackerOne reports will be closed as informative and asked to move to GitHub.
- The project says it cannot ignore true low-severity bugs because of CVE appeals.
- Distros and other curl users may see security fixes earlier through the public process.
- 1.From October 26, 2026, file curl reports rated low or medium as public GitHub issues.
- Organizations
- curl projectHackerOne
From the original article
4 min read at daniel.haxx.se
The curl project has decided to alter its vulnerability disclosure program procedure and starting October 26 2026 , we insist that all vulnerability reports submitted to us that are deemed to be severity LOW or MEDIUM should instead be submitted as issues in our GitHub repository . Only vulnerabilities deemed to be HIGH or CRITICAL will be kept private in the HackerOne tracker .
By daniel.haxx.se via robalex · daniel.haxx.se
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.