Daniel Stenberg, Curl project lead, highlights a systemic issue in open-source vulnerability disclosure: reporters inflating bug severity to obtain CVE numbers for publicity. As a CVE Numbering Authority (CNA) since 2024, Curl has issued 57 CVEs but recently rejected a report for a wildcard certificate validation bug deemed low/non-critical. The reporter appealed to MITRE multiple times; MITRE ultimately confirmed it is not a security vulnerability. This case illustrates the tension between strict security standards and incentive misalignment in vulnerability reporting.