The „else“ part being we lose our CNA status. That would mean anyone else could publish a CVE for #curl.

And „publish“ here means the finding only. Which, once done, is near impossible to debate/reclassify afterwards.

This means a #curl release is tainted with a CVE we learn about the same time everyone else does. Without communication to the reporter and no fix.

The security scanners will report it and your legal contracts will require you to remove it from your systems or become liable.

In computer science, this would be regarded as s flow control problem. The solution: limit your inbox window, drop incoming data beyond that.

This #curl did during its Summer of Bliss 2026.

BUT: this is not allowed in the CVE system.

So, everyone look away while we did this, requiring us to immediately start working should something really bad prop up. Or else.

The simple observation:

The #curl project is getting DoS‘ed by security researchers.

No mal intent, but driven by stock/work market evaluations.

Example: Aisle has shown its value by the curl CVEs claimed and was now bought by Cohere, presumably a good deal for both companies.

Economically reasonable behaviour for both. The FOSS projects are the roadkill, though.

All reporters have similar motivations, down to individuals improving their personal market value.