@Suiseiseki I guess technically. I can see an argument in this case for denial of service, but it's hardly 9.8 out of 10 on risk. The bug was fixed nearly 4 years before the cve was published, but even if someone is still running the vulnerable version it's not like that means they are going to use retries with a large number capable of overflow. A malicious user would likely use smaller increments for retry anyway. It isn't like curl has some kind of web interface that makes it available to unauthorized users.