[Palmik]

To anyone that knows what the vulnerability is, this announcement does not bring any new information.

[tsimionescu]

I suppose it's theoretically possible someone was hoarding this as a zero-day and may decide to more actively exploit it before it gets patched. Except of course that they don't know which precise vulnerability it is.

[Ekaros]

Also what I consider is that who has insider access and how does that information leak... This fix must be known at least some members of curl developers. Will they leak it or not? Or anyone who receive it early...

[rowanG077]

It most definitely does. You know it's going to be patched. You no longer have to tiptoe around to conceal the problem. This can be the difference between snooping a bit of data here and there and just straight up dumping the contents of entire servers.

Of course this depends on the vulnerability itself. But knowing a vulnerability will be patched can be hugely interesting and worthwhile information

[tsimionescu]

Except of course they don't know what vulnerability is getting patched. So, they might actually end up revealing a different vulnerability.

[rowanG077]

Of course. It's a risk that could easily be worth it depending on the actor and vulnerability