This is a great writeup. However, even after also reading the CVE, I'm still unsure about under which circumstances you would be affected. As far as I understand it, you are affected if you

* use a SOCKS5 proxy, AND

* you use the SOCKS5 proxy to resolve hostnames (which AFAICS is NOT the default), AND

* the size of the buffer was changed from the default (100kb) to something below 65541 bytes, AND (EDIT: Not correct: 'libcurl' re-uses the download buffer for this, which by default is 16kB, however it is said that 'curl' itself sets it manually to 100kb UNLESS you use --limit-rate)

* the SOCKS5 proxy is too slow to handle the request immediately (which however, as the CVE states, can usually be provoked if the attacker has control over the request rate). (EDIT: This is wrong, the CVE actually says "Typical server latency is likely "slow" enough to trigger this bug without an attacker needing to influence it by DoS or SOCKS server control.")

So to me, the attack vector seems very small. Am I missing something?