Starting October 26, 2026, the curl project will require low-severity and medium-severity vulnerability reports in its public GitHub repository, reserving private HackerOne handling exclusively for high-severity and critical-severity reports.
Curl maintainer Daniel Stenberg stated that key maintainers are strained and overloaded by a continuous volume of low-severity vulnerability reports.
The curl project previously shuttered its bug bounty program in early 2026 due to an influx of AI-generated security vulnerability submissions piling work onto maintainers.
Security researchers who are uncertain of a vulnerability's severity can still submit the issue on HackerOne for curl maintainers to assess.
Security researchers using AI tools are generating unusual option combinations in curl and reporting minor discrepancies as vulnerabilities, according to maintainer Daniel Stenberg.
Public disclosure of low-severity and medium-severity curl flaws gives potential attackers more time to exploit vulnerabilities before official security fixes arrive.
Public handling of curl vulnerability reports is intended to allow more community members to assess reports, develop fixes, write advisories, and check for related problems before software releases ship.
Over 90 percent of all security vulnerability submissions to the curl project over recent years were assessed to be below high severity, according to maintainer Daniel Stenberg.
A report published by The Data Drop found that 11 out of 23 listed critical open-source software projects operate with only one or two maintainers.
Research by The Data Drop indicates that critical open-source software projects widely used in modern computing systems face scarce or nonexistent funding.