The curl project will stop accepting and processing vulnerability reports for roughly one month in July 2026, giving its maintainers a planned break after what the project describes as four months of intense pressure. The pause, called the “summer of bliss,” begins at 00:00 CEST on July 1 and ends when submissions reopen at 09:00 CEST on August 3.
Curl’s HackerOne submission form will be disabled during that period. Sending a report to the project’s security email address will not provide an alternative route: maintainers say those messages will not be processed, consistent with their general policy of not accepting vulnerability reports by email. Researchers who find an issue during the closure are being asked to hold it until the HackerOne form returns.
The decision is unusual for a widely deployed networking project, but its scope is specific. curl’s ordinary GitHub issue tracker and pull-request workflow will remain active, so bug fixes and new code can continue. Maintainers may spend some of the quieter period on development, but the stated priority is reducing pressure and allowing time for rest, travel and family. Customers with paid support contracts will continue to receive service during the pause.
The project has not suggested that incoming security work is permanently declining. On the contrary, its announcement says maintainers do not expect the recent deluge to end. Temporarily closing the intake channel prevents a queue from continuing to generate immediate review obligations while the team is away. It also makes the delay visible to reporters rather than silently leaving submissions unattended.
A backlog may still be waiting when HackerOne reopens. To give maintainers more time to handle reports accumulated around the break, curl has moved version 8.22.0 back by two weeks. The release is now scheduled for September 2, 2026. The announcement does not promise response times after reopening, so researchers should expect triage to resume rather than every deferred case to be resolved immediately.
The pause highlights a structural issue for foundational open-source software. A project can be embedded across large commercial systems while vulnerability review remains concentrated among a limited group of specialists. Continuous disclosure creates an always-on operational burden, especially when report volume includes low-quality or automated submissions. curl’s post does not quantify the recent load, so the exact composition of that pressure is not established here.
For security teams, the practical instruction is to plan around the published dates and avoid email disclosure. For the broader ecosystem, the experiment will show whether a clearly announced intake holiday can protect maintainer capacity without creating unacceptable coordination risks. curl also invited other open-source projects to take similar breaks and report their experience afterward, turning a staffing necessity into a public test of more sustainable maintenance.
