As by the rules for CNAs, which curl is, we have to respond within 72 hours when asked for a CVE for a "Publicly Disclosed Vulnerability". This is counter to our summer of bliss of course.

We have never seen such a disclosed curl vuln in the past so chances are low they will happen while we go bliss. Should they still, we will just live with it and our root CNA will step in and we take the fall-out when we return to business.