> The second unnerving thing is that many of the listed vulnerabilites target embedded libcurl; a library with a much slower update cycle.

I am guessing the slower update cycle is an issue where it is statically linked?