Buy commercial curl support. We
help you work out your issues, debug your libcurl applications, use the API,
port to new platforms, add new features and more. With a team lead by the
curl founder Daniel himself.
[PROPOSAL] Every vulnerability report < HIGH is immediately public
- Contemporary messages sorted: [ by date ] [ by thread ] [ by subject ] [ by author ] [ by messages with attachments ]
From: Daniel Stenberg via curl-library <curl-library_at_lists.haxx.se>
Date: Sun, 18 Oct 2026 00:00:36 +0200 (CEST)
Hey,
After having spent my whole Saturday triaging vulnerability reports and yet
they keep pouring in, I realize we need to change the game or we will go
under.
I propose we start making all reports public immediately, unless we deem them
severity HIGH or CRITICAL. Only if they are of that super important category
do we handle them in secret and with embargo, all other reports we handle like
we handle all other bugs: discussions and fixing entirely in the public. This
way everyone can help out, assess and assist with testing, debugging and
coming up with fixes.
I also posted this proposal as a GitHub discussion:
https://github.com/curl/curl/discussions/23458
What would be the downside? What else should be considered? What could be
further improved?
Date: Sun, 18 Oct 2026 00:00:36 +0200 (CEST)
Hey,
After having spent my whole Saturday triaging vulnerability reports and yet
they keep pouring in, I realize we need to change the game or we will go
under.
I propose we start making all reports public immediately, unless we deem them
severity HIGH or CRITICAL. Only if they are of that super important category
do we handle them in secret and with embargo, all other reports we handle like
we handle all other bugs: discussions and fixing entirely in the public. This
way everyone can help out, assess and assist with testing, debugging and
coming up with fixes.
I also posted this proposal as a GitHub discussion:
https://github.com/curl/curl/discussions/23458
What would be the downside? What else should be considered? What could be
further improved?
-- / daniel.haxx.se || https://rock-solid.curl.dev -- Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-library Etiquette: https://curl.se/mail/etiquette.htmlReceived on 2026-10-18