Loading story…
curl announced that, starting October 26, 2026, vulnerability reports assessed as LOW or MEDIUM severity must be submitted publicly through GitHub issues, while HIGH and CRITICAL reports will remain private through HackerOne under embargo. The decision follows an October 17 proposal and community discussion about an overwhelming reporting workload for the small security team. Maintainer Daniel Stenberg said more than 90% of submissions in recent years were quickly assessed as below HIGH severity, with AI-generated reports contributing unrealistic libcurl configurations and execution scenarios.
Public handling is intended to broaden participation in triage, testing, advisory preparation, and fix validation while giving distributions and users earlier visibility. Formal CVE records and security advisories will still accompany releases containing fixes. curl acknowledges that earlier disclosure gives attackers a somewhat longer exploitation window; community participants also raised severity-misclassification and downstream vulnerability-management concerns. The project plans to reject more reports that do not meaningfully affect users. Organizations using curl should monitor public issues for relevant exposure and pending fixes alongside official advisories, rather than treating every report as a confirmed vulnerability.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
Bagder linked proposed process update #23483 and clarified that formal CVE records and security advisories would remain synchronized with releases containing fixes. Reports and discussions about lower-severity vulnerabilities could become public substantially earlier.
Daniel proposed on GitHub and the curl-library mailing list that LOW- and MEDIUM-severity vulnerability reports be discussed and fixed publicly to distribute the workload. HIGH and CRITICAL reports would remain confidential and under embargo.
Curl received 13 vulnerability reports, and Daniel reported spending the entire Saturday triaging submissions while more arrived. He said the small security team could not sustainably handle that volume privately.
Curl announced that LOW- and MEDIUM-severity reports would be submitted publicly through GitHub under a procedure scheduled to begin October 26, 2026, while HIGH and CRITICAL reports would remain private in HackerOne. Researchers uncertain about severity could still use HackerOne, with lower-severity submissions redirected to GitHub.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
daniel.haxx.se
Open sourcegithub.com
Open sourcecurl.se
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The *cURL* project’s maintainer **Daniel Stenberg** announced the termination of cURL’s vulnerability reward/bug bounty program after the security team was overwhelmed by a surge of low-effort, largely **AI-generated** vulnerability submissions that consumed maintainer time and created burnout risk. Stenberg stated the small open-source team could not keep up with the volume and warned that repeated low-quality submissions would lead to bans and public criticism, framing the decision as necessary to protect project sustainability and maintainer well-being. Reporting indicates the change is being implemented via updates to cURL’s documentation (including `BUG-BOUNTY.md`) and will take effect at the end of January 2026, removing references to the project’s **HackerOne** program and stating that cURL will no longer offer rewards for reported vulnerabilities or assist researchers in obtaining compensation from third parties. The program had operated since 2019 via HackerOne and the Internet Bug Bounty, and the decision has raised concerns among users that eliminating bounties may reduce incentives for high-quality private reporting despite cURL’s widespread use across major operating systems and software stacks.
Jun 29, 2026
curl 8.23.0 fixes **24 vulnerabilities**, including the high-severity HTTP/2 upload use-after-free flaw `CVE-2026-92392` and 23 low-severity issues. A malicious HTTP/2 server can manipulate an upload and stream teardown, leaving libcurl with a pointer to a freed transfer handle; memory-address leakage and attacker-controlled data can then enable a function-pointer overwrite and remote code execution. Exploitation requires tightly constrained upload sizes, memory-allocation behavior and platform knowledge, and maintainers consider a crash much more likely than successful code execution. Luna Tong at Anthropic reported the flaw using OSS Scanner, prompting an accelerated release while the project continues replacing internal handle pointers with transfer identifiers and expanding testing. The release also removes **SMB and SMBS support** from curl and libcurl, following curl 8.20.0's decision to make NTLM and SMB support opt-in at build time. curl's SMB implementation supported only SMBv1 and depended on NTLM, whose connection-level authentication added complexity and contributed to at least seven historical curl vulnerabilities. Version 8.23.0 additionally includes 281 bug fixes and deprecates `CURL_GLOBAL_WIN32` in favor of `CURL_GLOBAL_WINSOCK`. Organizations should prioritize updating deployed curl and embedded libcurl components, especially clients uploading to untrusted HTTP/2 servers, and identify workflows requiring replacement SMB functionality before upgrading.
Oct 18, 2026
Anthropic’s **Mythos** vulnerability-hunting model identified five purported security issues in the `curl` codebase, but curl founder Daniel Stenberg and the project’s security team validated only one as a real vulnerability. Stenberg said three findings were false positives already addressed by API documentation, while another was a non-security bug; the sole confirmed issue is described as **low severity** and is expected to be fixed in `curl 8.21.0`, with disclosure planned alongside that release. He said the model was tested through Anthropic’s Project Glasswing rather than by direct access to the repository. Stenberg said the results did not support claims that Mythos is uniquely effective at finding software flaws, calling the surrounding promotion more marketing than breakthrough. He added that AI-assisted code analysis is still useful and has improved substantially over traditional static analysis, but argued Mythos showed no clear advantage over other modern AI tools already used on curl’s heavily audited codebase. Broader discussion in the security community has also pointed to orchestration frameworks and workflow design—not just frontier models—as effective ways to uncover vulnerabilities, reinforcing skepticism that a single high-end model alone represents a major leap in bug hunting.
Jul 20, 2026