A CVE Dispute

The curl project, a CNA, has issued 57 CVEs and handles vulnerability assessment internally, assigning severity levels from LOW to CRITICAL and sometimes classifying issues as lower than LOW to avoid unnecessary CVEs. On February 10 2026, a reporter disputed curl’s decision not to assign a CVE to a niche bug involving hostnames with a leading dot that affect wildcard certificate matching, prompting curl to defend its original judgment to MITRE.