curl is taking July off from security bug reports.
Daniel Stenberg, who created and still primarily maintains the widely-used data-transfer library, posted on his personal blog that curl will not accept vulnerability reports for the entire month of July 2026. The post, titled "curl summer of bliss," frames the decision as a deliberate summer break. Any researcher who finds a flaw in July is, by design, waiting until August.
The gap is easy to understate. curl handles data transfer across operating systems, cloud platforms, programming runtimes, and consumer devices at a scale that makes it one of the most-targeted surfaces in open-source software. A company with a dedicated security team would never announce a scheduled month-long intake blackout; curl operates on a different model, and that model is largely one person.
Somewhere in this announcement is the compressed form of the open-source sustainability problem: the more critical a piece of infrastructure becomes, the more its maintainers need a break from it — and the more that break costs everyone else.