On 24/09/2026 15.56, Daniel P. Berrangé wrote:
Recently QEMU has received a denial of service attack on
its bug tracker in the form of 120 reports in 10 minutes,
and now repeated by another reporter in the form of 50
reports in the same day.
Prior to switching security disclosures to the bug tracker,
single reporters have submited 18, 22, and 114 bug reports.
None of this is sustainable. It is an effective denial of
service attack on the project maintainers' time. Every bug
report is a TODO item added to someone's workload.
It is time to put hard limits on how many bugs, discovered
with assitance of automated tools, we are willing to accept
in a givenm time frame.
This patch proposal suggests
* No more than 5 bugs per week, per reporter
* No more than 10 bugs are permitted to be open at any
time, per reporter.
This is explicitly scoped to bugs discovered with the assistance
of automated tools. Bugs where a human puts in exclusively
personal time / effort to discover a problem are not limited.
I think this is a good idea, thanks for writing it up!
diff --git a/contribute/report-a-bug.md b/contribute/report-a-bug.md
index b506f9f..8fb7b0b 100644
--- a/contribute/report-a-bug.md
+++ b/contribute/report-a-bug.md
@@ -32,6 +32,43 @@ on GitLab, taking into account the following guidance.
triage of their output to validate all findings and reproducer
scenarios prior to submitting a bug report.
+* QEMU policy forbids the bulk filing of large numbers of
+ bug disclosures that were generated with automated tools
+ (AI/LLM, static analysis, fuzers). Such actions are not
s/fuzers/fuzzers/ ?
If you agree, I can fix the typo and commit the patch, no need to respin.
Thomas
