Just like a browser curl is parsing, processing and making decisions based on untrusted input. There have been exploits against web clients using malformed hea

Just like a browser curl is parsing, processing and making decisions based on untrusted input. There have been exploits against web clients using malformed headers, status codes, using buffer overflows, broken parsing of character sets and more. Curl just happens to have a really good developer that has avoided most of these pitfalls. To find some examples of the exploits one could pull down all the metasploit modules, glance through the OWASP database or look through the change logs for all the major browsers.