Is it possible that curl just doesn't have any critical security vulnerabilities left?