I agree, but take it one step further: if you're not deeply familiar with mature and/or complex software, assume you are wrong. Assume however you verified it is incorrect.

Curl is a very old piece of software that is incredibly reliable, built in a language that allows you to do evil things.

If you find what looks like a bug or vulnerability, there is a good chance it's not. There's a good chance that because of specific circumstances that came to be 15 years ago, the code will never execute in such a way to cause a bug.