The author (me) did get a visa, after a mere 937 days: https://daniel.haxx.se/blog/2020/11/09/a-us-visa-in-937-days...
I guess it's probably in everything curl or will be?
Our process for handling security problems in curl is documented here: https://curl.se/dev/secprocess.html