CVSS is dead to us

Daniel Stenberg, creator of cURL, explains why he and the cURL project are stepping away from CVSS scores. His argument: CVSS often misrepresents real-world impact, encourages fear-driven narratives, and creates friction with vendors and users alike. He shares specific examples where scoring led to misunderstanding or pressure to overhype relatively low-risk bugs. The main exhibit is CVE-2024-11053, a netrc and redirect credential leak that curl rated low and CISA’s enrichment scored as a critical 9.1. In December, Stenberg asked CISA in a pull request to lower that to a medium 5.3, since an attacker first needs to tamper with the victim’s own .netrc file.