Curl Pauses Vulnerability Reports for All of July 2026

Key Takeaways

• Curl's HackerOne form and security email will be inactive from July 1 to August 3, 2026
• The curl 8.22.0 release is delayed two weeks to September 2, 2026 as a result
• Paid support contract holders will still receive full service during the hiatus

The curl project, one of the most widely deployed pieces of software on the internet, is shutting down its security reporting channels for an entire month. Starting July 1, 2026, the project's HackerOne submission form goes dark. The security email address becomes a dead end. Any vulnerability you find will have to wait until August.

Lead maintainer Daniel Stenberg announced the initiative, which he calls the "curl summer of bliss." The reason is straightforward: the maintainers are exhausted and need a break.

“Whatever issue you find that you feel a need to report to the curl project during this month has to wait.”

— Daniel Stenberg, Lead Maintainer of curl

The Details

The hiatus runs from July 1, 2026 at 00:00 CEST to August 3, 2026 at 09:00 CEST. That's 33 days where security researchers cannot submit vulnerability reports through official channels.

The project's GitHub issue and pull-request trackers will remain open and active. This is not a complete shutdown. But anything security-related gets shelved.

One exception exists: paid support contract holders will continue to receive full service throughout July. If you have a contract with the project, you can still report issues and expect a response.

Why This Is Happening

Stenberg referenced "huge pressure for the last four months or so" as the driving factor. The curl project has been dealing with a deluge of vulnerability reports, and the maintainers need rest. They do not expect this pressure to subside after the break.

This highlights a fundamental tension in open-source software. Curl is everywhere. It ships in billions of devices. It's embedded in operating systems, applications, and infrastructure across the globe. Yet the project depends on a small group of maintainers who handle an enormous workload, much of it without compensation.

“We call it the curl summer of bliss. We will not process or otherwise care about security or vulnerability reports sent to us [during this time].”

— Daniel Stenberg, Lead Maintainer of curl

The Risk Calculation

Stenberg addressed the obvious concern directly in his announcement. "The bad guys won't rest," he wrote. His response: "Probably not. But we will."

If a critical zero-day emerges in curl during July, the project will learn about it in August. That's the tradeoff. For Stenberg, maintainer sustainability outweighs the risk of a delayed response window.

The approach is pragmatic. A burned-out maintainer makes more mistakes, moves slower, and eventually quits. A rested maintainer can handle the August backlog and continue working for years. The project is betting that one month of delayed reports is less damaging than losing key contributors to burnout.

Community Response

Reaction on Hacker News has been largely supportive. Many commenters praised the decision as a necessary step for maintainer mental health. Several discussions focused on the "human cost" of maintaining foundational open-source software.

A recurring theme in the discussion: large corporations that rely on curl should contribute more to its sustainable maintenance. When software is free and ubiquitous, the people maintaining it often bear costs that users never see.

Stenberg invited other open-source projects to join the initiative. "If you and your Open Source projects also want to participate in the summer of bliss 2026: just do it and let us know!" he wrote. "I would of course encourage you to do so. To take care of yourself as a top priority."

What This Means for Users

If you discover a curl vulnerability in July 2026, document it, hold it, and submit it on August 3 or later. Do not email the security address. Do not try to use HackerOne. Neither will be monitored.

If you run infrastructure that depends on curl and want guaranteed support during this period, you need a paid support contract. That's the only path to July coverage.

The curl 8.22.0 release, originally scheduled for mid-August, now ships September 2, 2026. Plan accordingly if you're tracking that version for security patches or new features.

Frequently Asked Questions

When does curl resume accepting vulnerability reports?

August 3, 2026 at 09:00 CEST. The HackerOne form will reopen at that time.

Can I email curl security issues during July 2026?

No. The security email address will not be monitored. All reports must wait until August.

Will curl's GitHub remain active during the Summer of Bliss?

Yes. Issue and pull-request trackers on GitHub stay open and active. Only security-specific reporting is paused.

What if there's a critical curl vulnerability discovered in July?

The project will learn about it in August. The only exception is for paid support contract holders, who will receive full service.

Source: Hacker News: Best