What's this about?
The six accepted CVEs, all rated Low: an OpenSSL provider use-after-free, an OpenSSL pinning bypass, a native CA store connection reuse issue, a secure-attribute bypass using a tab character, a wolfSSL CA-cache hit overriding a callback, and a domain-scoped public-suffix cookie. AISLE's own framing: this profile is consistent with curl's exceptional engineering maturity — the vulnerabilities that remain hide in narrow configurations and subtle interactions, which limits their practical impact.
Why report Low-severity findings as a headline result?
Because in a codebase this mature, Low severity is what real remaining bugs look like. Nobody is finding a remote code execution in curl in 2026. The interesting property is not impact but *novelty*: each is a previously unknown flaw in production code, reproduced and accepted by domain experts, then fixed for deployed users. That is a much harder bar than a benchmark score, and a much lower bar than "dangerous."
Why does this matter to you?
- It is a useful calibration against the week's capability announcements — this is what "AI found real vulnerabilities" looks like in practice.
- The bug classes are instructive: pinning bypass, cache-hit overriding a callback, a tab character defeating an attribute check. All are interaction bugs, not memory-safety spectaculars.
- Read against OpenAI's Astra claims from two days ago — those were zero-days in a hardened browser and OS. Both are real; they are different weight classes.