“After my pull request it took less than ninety minutes for them to update the curl records. Without explanation, with no reference to my PR, they now apparently consider the issue to be CVSS 3.4.”
curl rated its bug low. CISA scored it 9.1 critical without anyone who knows curl. Scanners lit up and contracts forced fixes on deadlines. CISA dropped it to 3.4 within 90 minutes of a complaint and explained nothing.