The NVD seems optimized for dealing with companies. It definitely provides a valuable service, but the service it provides is something like “ingesting all the

The NVD seems optimized for dealing with companies. It definitely provides a valuable service, but the service it provides is something like “ingesting all the company PR about a given security issue and distilling it into an automated format for algorithmic consumption”. Curl has a particular combination of extremely high deployment numbers and very few developers. This pattern is common in open source projects, but (vanishingly) rare in commercial projects. But almost everything the NVD evaluated is a commercial project, which is probably why the NVD struggles so much to get it right on curl. The compromise solution is probably something like an “open source security issue” evaluation agency - it can take assessments derived from actual ability to read the code, and adapt it to a “press release” format that the NVD can handle. Basically an interface issue.