Based on information from The Register, the curl project is changing how it handles security vulnerability reports to manage an overwhelming influx of submissions.
Starting Oct. 26, the open source data transfer tool will require low and medium-severity vulnerability reports to be filed in its public GitHub repository. The project will reserve private handling for high and critical flaws. Maintainer Daniel Stenberg stated that the policy change is a survival strategy necessitated by an avalanche of reports, many of which are generated by artificial intelligence. Stenberg noted that over 90% of submissions are assessed as less than high severity. The project previously closed its bug bounty program earlier this year to address the rising workload caused by AI-generated submissions. These automated reports often highlight unusual option combinations that are unlikely to occur in real-world applications. While public disclosure may provide attackers more time to exploit flaws before fixes are released, the project maintainers argue that the current volume of reports is unsustainable for their limited team. By moving these reports to a public forum, the project hopes to distribute the assessment and remediation workload among a broader community of contributors.
Source: The Register
