Oracle shipped nine security fixes to curl yesterday: https://linux.oracle.com/errata/ELSA-2019-1880.html - fixes we announced in **2016**. We've announced several more problems after that for the version they ship...