It used to be that anybody could issue CVE for anything, which lead to some pretty bad CVEs. But now there's a CNA program in place, and has been for several years, where the organization can register as a CVE source for a product or a set of products, and nobody would be issuing CVEs for those products. Not sure how 2020 CVE even got in the system - you shouldn't be able to reserve 2020 CVE now, so it appears as if somebody got a CVE ID reserved three years ago and just decided for some reason to publish it as curl CVE. Not sure if the current system has any protections against such abuse...