libxml2 Maintainer Ends Embargoed Vulnerability Reports, Citing Unsustainable Burden

stapp · Jun 18, 2025

The lone volunteer maintainer of libxml2, one of the open source ecosystem’s most widely used XML parsing libraries, has announced a policy shift that drops support for embargoed security vulnerability reports. This change highlights growing frustration among unpaid maintainers bearing the brunt of big tech’s security demands without compensation or support.
In a post closing the issue on the project’s tracker, maintainer Nick Wellnhofer explained that triaging security reports, often of questionable severity, is taking “several hours each week,” time that he says is unsustainable for an unpaid volunteer.
"My one-man company recently tried to become a OpenSSF member. You have to become a Linux Foundation member first which costs at least $10,000/year. These organizations are very exclusive clubs and anything but open. It's about time to call them and their backers out."
Wellnhofer said he recently stepped down as libxslt maintainer and that it's unlikely that the project will ever be maintained again.
Click to expand...

https://socket.dev/blog/libxml2-maintainer-ends-embargoed-vulnerability-reports

stapp · Jun 19, 2025

I must admit I had no idea it cost so much for a one man company to become a Linux Foundation member.
I also see

Libxml2 ships with billions of devices worldwide, despite being maintained by a single volunteer. Its widespread adoption is a root cause of the problem, according to Wellnhofer:
“The point is that libxml2 never had the quality to be used in mainstream browsers or operating systems to begin with. It all started when Apple made libxml2 a core component of all their OSes. Then Google followed suit and now even Microsoft is using libxml2 in their OS outside of Edge. This should have never happened.”
He added that the big vendors’ approach amounts to avoiding responsibility for technical debt.
Click to expand...

Log in or Sign up

libxml2 Maintainer Ends Embargoed Vulnerability Reports, Citing Unsustainable Burden

stapp Global Moderator

stapp Global Moderator

Log in or Sign up

libxml2 Maintainer Ends Embargoed Vulnerability Reports, Citing Unsustainable Burden

stapp Global Moderator

stapp Global Moderator

Useful Searches