curl's First CVE Dispute

Daniel Stenberg documents curl’s first CVE dispute since becoming a CNA, and it is a tidy case study in what “vulnerability” even means. A researcher contested curl’s rejection of a CVE for a wildcard-certificate hostname-matching quirk in Curl_cert_hostcheck() that required an illegal leading-dot DNS name, a specific TLS backend, and a local attacker already in place. The fix had already landed in December 2025: a two-line change in lib/vtls/hostcheck.c that refuses a wildcard match when the hostname starts with a dot, plus two new unit test cases. Stenberg filed it under “lower than LOW,” and MITRE’s Top-Level Root agreed it is not a security vulnerability. In an era of CVE inflation, disputing them is becoming its own job.