See curl's VULN-DISCLOSURE-POLICY.md for full details.
If you have found or just suspect a security problem somewhere in curl or libcurl, report it on https://hackerone.com/curl.
We treat security issues with confidentiality until controlled and disclosed responsibly.