Curl Project Pauses Bug Reports Amid AI Submission Overload

The curl project announced it will not accept security vulnerability reports from July 1 to August 3, 2026, due to overwhelming pressure from AI-generated submissions. Maintainer Daniel Stenberg cited a dramatic increase in reports, with the volume doubling from 2025, leading to burnout among developers. During this 'summer of bliss,' only paid support contracts will receive service, while general bug reports can still be submitted via GitHub. The decision reflects a broader trend among open-source maintainers prioritizing their well-being amidst rising workloads. Stenberg noted that the quality of AI-generated reports has improved, but the sheer number remains unsustainable. The curl 8.22.0 release has been delayed by two weeks to September 2, 2026. Despite the pause, critical issues may still be addressed if they arise.

Key Points: • Curl will not accept vulnerability reports from July 1 to August 3, 2026. • The decision is due to an overwhelming increase in AI-generated security reports. • Only paid support contracts will receive service during this period.