Threat reportVulnerabilityTL-2026-3972
curl Moves Low/Medium-Severity Vulnerability Handling to Public GitHub Amid AI-Driven Report Flood
curl Moves Low/Medium-Severity Vulnerability Handling to (TL-2026-3972), also tracked as curl public vulnerability handling change, is a low-severity software vulnerability, first published 2026-10-20. It has no confirmed attribution, affects curl project curl / libcurl, maps to 5 MITRE ATT&CK techniques (T1190, T1588.006, T1592.002), and is covered by 9 detection rules and 13 indicators of compromise.
- Severity
- LOWAssessed severity
- CVEs
- 0None referenced
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 13Indicators of compromise
Key facts for TL-2026-3972
- Threat ID
- TL-2026-3972
- Also known as
- curl public vulnerability handling change, Do minor curl vulnerabilities in the open
- Severity
- LOW
- Status
- MONITORING
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software, open-source, cloud, telecoms, government administration
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 13
Malware and tooling in curl Moves Low/Medium-Severity Vulnerability Handling to
Malware and tooling: embargo
How curl Moves Low/Medium-Severity Vulnerability Handling to works
From October 26, 2026 the curl project will require LOW and MEDIUM severity vulnerability reports to be filed as public GitHub issues, keeping only HIGH and CRITICAL reports private on HackerOne. The change responds to an avalanche of reports, many AI-assisted, and the maintainer acknowledges that public handling gives attackers more time to exploit minor flaws.
This is a vulnerability-disclosure process change, not a newly disclosed exploitable flaw. No CVE, CVSS score, exploitation, PoC or threat actor is associated with it. It is tracked because it alters the exposure window for a ubiquitous open-source component (curl / libcurl).
Per Daniel Stenberg's October 20, 2026 post 'Do minor curl vulnerabilities in the open', curl will insist from October 26, 2026 that all reports deemed LOW or MEDIUM severity be submitted as issues in the public GitHub repository instead of the private HackerOne tracker. HIGH and CRITICAL reports remain private on HackerOne. Researchers unsure of severity can still submit on HackerOne, where the team will state the severity it assigns; LOW/MEDIUM reports submitted there will be asked to resubmit on GitHub. The project states that over 90% of recent submissions could quickly be assessed as less than HIGH.
The stated driver is report volume. Stenberg describes an 'avalanche' of reports, with an 'army of AI-using researchers' appearing after CVE announcements and AI models producing unusual option combinations with minimal real-world impact. Maintainers described themselves as strained and overloaded, and said they 'must act to survive'. The project acknowledges two risks: LOW/MEDIUM issues become immediately visible to potential attackers, extending the exploitation window, and a researcher may understate the severity of a HIGH issue.
Background from secondary reporting: curl ended its paid HackerOne bug bounty on January 31, 2026 after about seven years and 87 confirmed vulnerabilities, and from March 1, 2026 used HackerOne only as an unpaid intake tool. The confirmed-vulnerability rate reportedly fell from roughly 15% to under 5%. curl accepted no reports from July 1 to August 3, 2026. curl 8.21.0 (June 24, 2026) fixed a record 18 CVEs: 4 Medium and 14 Low according to one secondary report. curl's existing policy already allows Low/Medium fixes to merge through normal pull requests without security language.
Defender implications: (1) public Low/Medium issues and fix commits in curl/curl can be mined by adversaries for n-day exploitation, and Low/Medium bugs are not covered by the private distros@openwall pre-notification process; (2) downstream vendors and distributors should monitor the curl GitHub issue tracker and commits rather than relying only on curl.se security advisories and CVE publication; (3) curl's severity labels are its own four-tier scheme and not CVSS, so Low/Medium may still matter in specific deployments. No IOCs, affected version ranges or attribution are stated in the sources.
MITRE ATT&CK techniques used in TL-2026-3972
Initial Access
T1190 Exploit Public-Facing Application
Resource Development
Reconnaissance
T1592.002 Software; T1593 Search Open Websites/Domains; T1595.002 Vulnerability Scanning
Affected products and versions in curl Moves Low/Medium-Severity Vulnerability Handling to
- curl project — curl / libcurl
Remediation for curl Moves Low/Medium-Severity Vulnerability Handling to
Patches
- Track curl releases at https://curl.se/changes.html and apply the latest stable release
Immediate actions
- Subscribe to or watch the curl/curl GitHub repository (issues and security-labelled commits) in addition to curl.se advisories
- Inventory every product, container image and build that bundles or links libcurl/curl
Workarounds
- Where a public Low/Medium issue affects a feature you use, disable or restrict that feature (protocol, option or proxy/auth mode) until a fixed release is deployed
Longer-term hardening
- Add curl/libcurl issue-tracker and commit monitoring to the vulnerability intelligence process, since Low/Medium flaws will be public before a fixed release
- Maintain a fast patch cadence for curl and libcurl across OS packages and vendored copies
- Triage Low/Medium curl issues against your own use of the affected protocol, option or feature rather than relying on the upstream severity label alone
Timeline of curl Moves Low/Medium-Severity Vulnerability Handling to
- Stenberg states curl will instantly ban reporters who submit AI slop reports, saying the project is 'effectively being DDoSed' (May 2025).
- curl shuts down its paid HackerOne bug bounty after about seven years and 87 confirmed vulnerabilities, citing AI-generated submissions.
- curl uses HackerOne only as an unpaid intake tool.
- HackerOne's Internet Bug Bounty pauses new submissions amid the AI-generated report surge.
- curl 8.21.0 ships fixes for a record 18 CVEs (4 Medium, 14 Low per secondary reporting), including CVE-2026-8932 dating to curl 7.7 (2001).
- curl stops accepting all vulnerability reports (the 'summer of bliss') until August 3, 2026.
- Pause on vulnerability reports ends and curl resumes intake.
- Stenberg publishes 'Do minor curl vulnerabilities in the open' announcing public GitHub handling for LOW and MEDIUM reports; The Register covers it the same day.
- New policy takes effect: LOW/MEDIUM reports must be filed as public GitHub issues; HIGH/CRITICAL remain private on HackerOne.
Sources cited for curl Moves Low/Medium-Severity Vulnerability Handling to
- Do minor curl vulnerabilities in the open (Daniel Stenberg)
- Swamped curl maintainers take low-level flaws public to survive vulnerability 'avalanche' (The Register)
- curl Vulnerability Disclosure Policy
- curl's Summer of Bliss: Why It Stopped Taking Bug Reports in July 2026 (Pinggy)
- Curl will stop bug bounties program due to avalanche of AI slop (TechRadar)
- Drowning in AI slop reports, curl ends bug bounties (The New Stack)
- curl 8.21.0 Fixes 18 Security Flaws, Including a 25-Year-Old libcurl Bug (VPNCentral)
- curl oss-security announcement, June 24 2026 (Openwall)
- curl GitHub repository
- curl HackerOne program
Detection coverage for TL-2026-3972
As of 2026-10-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3972 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.