curl will handle low and medium security bugs in public from 26 October

curl will handle low and medium security bugs in public from 26 October

20 October 2026: The curl project, whose library sits inside a vast range of operating systems, devices and applications, will stop handling low and medium severity vulnerability reports in private from 26 October. Reports it rates LOW or MEDIUM must be filed as public issues in its GitHub repository; only HIGH and CRITICAL reports stay private on HackerOne, the bug bounty platform it uses today.

Not yet independently verified. This rests on the maintainer's blog post; curl's published disclosure policy page had not been updated to match when we read it. We will update this when it can be confirmed, and remove this note.

Why the project is changing course

Lead developer Daniel Stenberg is direct about the cause: "This policy change is entirely triggered by the current avalanche of vulnerability reports that keep pouring in." He writes that over the last few years more than 90% of submissions could quickly be judged as less than HIGH, that handling them all in private is straining the few maintainers who see them, and that he does not expect the flow to slow in the next several months. Working in the open lets more people help assess a report, check a fix and spot related problems before a release.

What happens to reports already filed

Researchers who are unsure how serious a finding is can still file on HackerOne, and the team will tell them which severity it assigns. Existing HackerOne reports the team rates LOW or MEDIUM will be asked to be resubmitted on GitHub, then closed as informative on HackerOne, which makes them public. curl will keep issuing CVEs for genuine low severity flaws, noting that the CVE system has an appeals route if it declines one, but says it will turn down more firmly reports that do not affect real users, such as unlikely combinations of options.

The trade-off for everyone who ships curl

Stenberg names the cost himself: public handling "will give bad people a slightly longer window of opportunity to exploit weaknesses" before a fix ships, which is why the line is drawn below HIGH. For companies that embed libcurl in products, the practical change is that low and medium issues will be visible on GitHub before a release rather than appearing first in the release notes, so a security team watching the repository sees them earlier and so does everyone else. The last release, curl 8.23.0, fixed 24 CVEs, a sign of the volume he describes.

Sources

• Daniel Stenberg: Do minor curl vulnerabilities in the open, 20 October 2026
• curl: Vulnerability disclosure policy (read 2026-10-21), 21 October 2026