[rustyhancock]

I think I'd personally develop a minimal patch and then publically disclose.

I'm not sure it's be reasonable to leave an actively exploited critical bug until August. Nor would I be too interested in playing middle man or paying for support from curl to get it out.

[zamadatix]

Disclosing an actively used exploit is is usually not treated the same as a typical vulnerability report.