curl, a widely used data transfer tool and library, ended its paid bug bounty program on January 31, 2026, due to a decline in the quality of submissions.
The vulnerability or weakness
The quality of submissions declined, with the share of confirmed vulnerabilities falling from over 15% to below 5% starting in 2025. The program had uncovered 87 confirmed vulnerabilities and paid over $100,000 to researchers.
Earlier attacks and coverage
- Rethinking Cybersecurity Awareness in the AI Era (2026-10-29)
Business impact
This decision affects the maintainers of curl, who now have to spend more time reviewing and verifying reports, which could delay the resolution of genuine security issues.
Industries affected
This impact is felt across various industries that rely on curl for data transfer and security, including software development, IT services, and cybersecurity firms.
Users affected
Users of curl, including developers and organizations that depend on the tool for data transfer, may face increased risk if the program's closure hinders the identification of new vulnerabilities.
Build these skills
Sources
- From Beginner to Bug Hunter: Learning Cybersecurity in the AI Era. (BleepingComputer)
