2 ms·

I think I'd personally develop a minimal patch and then publically disclose. I'm not sure it's be reasonable to leave an actively exploited critical bug until

I think I'd personally develop a minimal patch and then publically disclose. I'm not sure it's be reasonable to leave an actively exploited critical bug until August. Nor would I be too interested in playing middle man or paying for support from curl to get it out.

zamadatix 3mo ago
Disclosing an actively used exploit is is usually not treated the same as a typical vulnerability report.