To be fair (and for people who didn't click the link), i think most of the vuln were in libcurl, not in curl itself.