Curl is now a CVE Numbering Authority

The post links to more context here: <a href="https:&#x2F;&#x2F;daniel.haxx.se&#x2F;blog&#x2F;2023&#x2F;08&#x2F;26&#x2F;cve-2020-19909-is-everything-that-is-wrong-with-cves&#x2F;" rel="nofollow">https:&#x2F;&#x2F;daniel.haxx.se&#x2F;blog&#x2F;2023&#x2F;08&#x2F;26&#x2F;cve-2020-19909-is-eve...</a><p>Last year, someone got got CVE&#x27;s assigned for a curl issue for code that didn&#x27;t exist AND managed to get a high severity assigned to it. So curl becoming a CNA lets them provide some control to this process.

&gt; In plain English, this means that we will reserve and manage our own CVEs in the future directly against the CVE database with no middle man, and also that we have a scope for CVEs that is our territory: curl and libcurl<p>Combining this and the announcement of the same for PostgreSQL, would be even better if each was the authority for the other. I’d trust either project to classify the severity of an issue in the other.<p>Being able to classify your own CVEs has a bit of a fox watching the hen house vibe to it.

Wow, that&#x27;s some history to this. I used to believe MITRE deserved some respect, but now, I&#x27;m not sure I do anymore.

When traffic is mad, one either drives the bus or goes under it, apparently.

No need to use curl, make HTTP requests great again with <a href="https:&#x2F;&#x2F;github.com&#x2F;ducaale&#x2F;xh">https:&#x2F;&#x2F;github.com&#x2F;ducaale&#x2F;xh</a>