Post
The simple observation:
The #curl project is getting DoS‘ed by security researchers.
No mal intent, but driven by stock/work market evaluations.
Example: Aisle has shown its value by the curl CVEs claimed and was now bought by Cohere, presumably a good deal for both companies.
Economically reasonable behaviour for both. The FOSS projects are the roadkill, though.
All reporters have similar motivations, down to individuals improving their personal market value.
In computer science, this would be regarded as s flow control problem. The solution: limit your inbox window, drop incoming data beyond that.
This #curl did during its Summer of Bliss 2026.
BUT: this is not allowed in the CVE system.
So, everyone look away while we did this, requiring us to immediately start working should something really bad prop up. Or else.
The „else“ part being we lose our CNA status. That would mean anyone else could publish a CVE for #curl.
And „publish“ here means the finding only. Which, once done, is near impossible to debate/reclassify afterwards.
This means a #curl release is tainted with a CVE we learn about the same time everyone else does. Without communication to the reporter and no fix.
The security scanners will report it and your legal contracts will require you to remove it from your systems or become liable.
So, we cannot really stop playing this suicidal game, racing to the bottom, without you losing access.
We can stutter the onslaught, somewhat under the radar, for short durations of bliss. We have not found another remedy, so far.
Should you think this sounds like a hostage situation, you might be right.
