# curl Moves Low/Medium-Severity Vulnerability Handling to Public GitHub Amid AI-Driven Report Flood

> From October 26, 2026 the curl project will require LOW and MEDIUM severity vulnerability reports to be filed as public GitHub issues, keeping only HIGH and CRITICAL reports private on HackerOne. The change responds to an avalanche of reports, many AI-assisted, and the maintainer acknowledges that public handling gives attackers more time to exploit minor flaws.

- **Published:** 2026-10-20T16:54:17Z
- **Last reviewed:** 2026-10-20T16:54:17Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3972
- **ID:** TL-2026-3972
- **Severity:** LOW
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 13 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This is a vulnerability-disclosure process change, not a newly disclosed exploitable flaw. No CVE, CVSS score, exploitation, PoC or threat actor is associated with it. It is tracked because it alters the exposure window for a ubiquitous open-source component (curl / libcurl).

Per Daniel Stenberg's October 20, 2026 post 'Do minor curl vulnerabilities in the open', curl will insist from October 26, 2026 that all reports deemed LOW or MEDIUM severity be submitted as issues in the public GitHub repository instead of the private HackerOne tracker. HIGH and CRITICAL reports remain private on HackerOne. Researchers unsure of severity can still submit on HackerOne, where the team will state the severity it assigns; LOW/MEDIUM reports submitted there will be asked to resubmit on GitHub. The project states that over 90% of recent submissions could quickly be assessed as less than HIGH.

The stated driver is report volume. Stenberg describes an 'avalanche' of reports, with an 'army of AI-using researchers' appearing after CVE announcements and AI models producing unusual option combinations with minimal real-world impact. Maintainers described themselves as strained and overloaded, and said they 'must act to survive'. The project acknowledges two risks: LOW/MEDIUM issues become immediately visible to potential attackers, extending the exploitation window, and a researcher may understate the severity of a HIGH issue.

Background from secondary reporting: curl ended its paid HackerOne bug bounty on January 31, 2026 after about seven years and 87 confirmed vulnerabilities, and from March 1, 2026 used HackerOne only as an unpaid intake tool. The confirmed-vulnerability rate reportedly fell from roughly 15% to under 5%. curl accepted no reports from July 1 to August 3, 2026. curl 8.21.0 (June 24, 2026) fixed a record 18 CVEs: 4 Medium and 14 Low according to one secondary report. curl's existing policy already allows Low/Medium fixes to merge through normal pull requests without security language.

Defender implications: (1) public Low/Medium issues and fix commits in curl/curl can be mined by adversaries for n-day exploitation, and Low/Medium bugs are not covered by the private distros@openwall pre-notification process; (2) downstream vendors and distributors should monitor the curl GitHub issue tracker and commits rather than relying only on curl.se security advisories and CVE publication; (3) curl's severity labels are its own four-tier scheme and not CVSS, so Low/Medium may still matter in specific deployments. No IOCs, affected version ranges or attribution are stated in the sources.

## MITRE ATT&CK

- T1593 Search Open Websites/Domains
- T1595.002 Vulnerability Scanning
- T1592.002 Software
- T1588.006 Vulnerabilities
- T1190 Exploit Public-Facing Application

## Sources

- [Do minor curl vulnerabilities in the open (Daniel Stenberg)](https://daniel.haxx.se/blog/2026/10/20/do-minor-curl-vulnerabilities-in-the-open/)
- [Swamped curl maintainers take low-level flaws public to survive vulnerability 'avalanche' (The Register)](https://www.theregister.com/security/2026/10/20/swamped-curl-maintainers-take-low-level-flaws-public-to-survive-vulnerability-avalanche/5304198)
- [curl Vulnerability Disclosure Policy](https://curl.se/dev/vuln-disclosure.html)
- [curl's Summer of Bliss: Why It Stopped Taking Bug Reports in July 2026 (Pinggy)](https://pinggy.io/amp/blog/curl_ai_slop_summer_of_bliss/)
- [Curl will stop bug bounties program due to avalanche of AI slop (TechRadar)](https://www.techradar.com/pro/security/curl-will-stop-bug-bounties-program-due-to-avalanche-of-ai-slop)
- [Drowning in AI slop reports, curl ends bug bounties (The New Stack)](https://thenewstack.io/drowning-in-ai-slop-reports-curl-ends-bug-bounties/)
- [curl 8.21.0 Fixes 18 Security Flaws, Including a 25-Year-Old libcurl Bug (VPNCentral)](https://vpncentral.com/?p=252684)
- [curl oss-security announcement, June 24 2026 (Openwall)](https://openwall.com/lists/oss-security/2026/06/24/1)
- [curl GitHub repository](https://github.com/curl/curl)
- [curl HackerOne program](https://hackerone.com/curl)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3972