Swamped curl maintainers take low-level flaws public to survive vulnerability 'avalanche'

curl maintainer Daniel Stenberg announced a policy change to handle the flood of vulnerability submissions, largely driven by AI-generated reports. Starting October 26, low and medium-severity issues will be filed in curl's public GitHub repository, while high and critical flaws receive private handling. The project previously shut down its bug bounty program due to AI submissions overwhelming the small security team. Stenberg stated over 90% of recent submissions were assessed as less than HIGH severity. Public handling aims to distribute work across the community while preventing the project from being 'drowned' by the volume.

Summary and key points written by AI from the headline and a short excerpt, so they can be incomplete or wrong. The Register did the reporting; read the original for the full story.