“漏洞报告雪崩”迫使 curl 将低严重程度的案例转为公开处理，仅对高危和严重漏洞保留私密处理。维护者 Daniel Stenberg 表示，从 10 月 26 日起，低和中等严重程度的报告应提交到该开源数据传输工具的公开 GitHub 仓库。
An "avalanche of vulnerability reports" is forcing curl to move lower-severity cases into public view, reserving private handling for high and critical flaws. From October 26, low and medium-severity reports should be filed in the open source data transfer tool's public GitHub repository, maintainer Daniel Stenberg said.
“拿不准的安全研究人员仍可在 HackerOne 提交问题，我们会告知他们我们判定的严重程度。过去几年里，超过 90% 的提交都能迅速被评估为低于 HIGH（高危）级别。”Stenberg 今年早些时候已关闭了 curl 的漏洞赏金计划，因为 AI 生成的提交给安全团队堆积了大量工作。Stenberg 此前曾承认，并非所有 AI 辅助的报告都不好，但目前的工作量要求做出另一种回应。
"Security researchers in doubt can still submit the issue on HackerOne and we can tell them what severity we deem it to be. Over the last few years, over 90 percent of all submissions could quickly be assessed to be less than HIGH." Stenberg already shuttered curl's bug bounty scheme this year as AI-generated submissions piled work onto its security team. Stenberg has previously acknowledged that not all AI-assisted reports are bad, but the workload now demands another response.
“这一政策变更完全是由持续涌入的漏洞报告雪崩触发的。我们看不到尽头，也不预期未来几个月内这股洪流会减弱。作为一个项目，我们正在挣扎，所有核心维护者都感到紧张、超负荷，已被推至极限。我们必须采取行动以求生存。这是我们生存策略的下一步，可能不是最后一步。我们的目标是不被淹没。”
"This policy change is entirely triggered by the current avalanche of vulnerability reports that keep pouring in. We see no end to them and we do not anticipate this flood to decrease within the next several months. "We are struggling as a project as all key maintainers feel strained, overloaded and brought to the brink of what we can muster.
Stenberg 表示，公开处理将让更多人评估报告、开发修复、撰写通告，并在版本发布前检查相关问题。他承认，公开处理漏洞报告不会减少每份报告的工作量，但可能分散负担，并使经验教训和文档更易查找。至少理论上是这样。公开披露也给攻击者留出了更多时间在修复到来前利用漏洞。维护者同意这很遗憾，却是不可避免的。
We must act to survive. This is our next step in a survival strategy. It might not be our last. We aim to not drown." Public handling would let more people assess reports, develop fixes, write advisories, and check for related problems before releases ship, Stenberg said. Handling vulnerability reports publicly won't reduce the work per report, he admits, though it could spread the load and make the resulting lessons and documentation easier to find. At least that's the theory. Public disclosure also gives attackers more time to exploit flaws before fixes arrive. The maintainer agrees this is unfortunate yet unavoidable.
“我们之所以将这种做法限制在‘高’级以下，是因为：至少这些问题并不严重。”Stenberg 表示，使用 AI 的研究人员正在生成现实应用中不太可能出现的异常选项组合，然后将微小的差异视为漏洞。“我们无法在保持理智的情况下继续走这条螺旋式上升的道路。我们没有足够的带宽、人力，甚至没有意愿以这种速度处理源源不断的漏洞报告。我认为很少有软件项目能长期承受这种长时间、大批量的洪流冲击。必须有所让步。” ®
"We limit this practice to less than HIGH for this reason: at least these problems are not terrible." Stenberg said researchers using AI are generating unusual option combinations unlikely to occur in real applications, then treating minor discrepancies as vulnerabilities. "We can't continue down this spiraling path with our sanity intact. We don't have the bandwidth, manpower or even will to handle a never-ending vulnerability reporting stream at this pace. I believe few software projects can stand this kind of prolonged high volume deluge for extended periods. Something needs to give way." ®