Crashes with stack traces ending in third party libraries but triggerable through curl

[nbars]

Hey everyone, I have a quick question related to reporting bugs with possible security implications. I found some crashes (assert & 0 deref), but they manifest in third-party libs (ngtcp2 & nghttp3) but can be triggered through curl.

Should these still be reported via Hacker One or to the respective projects? Since I don't know the actual root cause of these bugs, I'm uncertain which way to go.

Best,
Nils

[jay]

Please report to curl on hacker one so the security team can look into it. Thanks