From the article “The report was for a legitimate bug, where the ‑‑retry‑delay option value was being multiplied by 1000 (to milliseconds) without an overflow c

From the article “The report was for a legitimate bug, where the ‑‑retry‑delay option value was being multiplied by 1000 (to milliseconds) without an overflow check. But what it was not was a security bug, Stenberg said; giving insanely large values for the option might result in incorrect delays—far shorter than requested—but it is not a security problem to make multiple requests in a short time span. If it were, "then a browser makes a DOS [denial of service] every time you visit a website — and curl does it when you give it two URLs on the same command line", he said in a followup post.” I agree there’s plenty of junk in the cve database but devils advocate: ‘a system relies on a user supplied sleep to trigger a web request which executes some function which if execute too quickly may cause double transaction execution or similar. Almost any functional bug (and arguably some UI bugs) _can_ have security or real world impacts under some scenario. CVE cannot generically say that any bug does not have security implications, noting that not all security bugs require a threat actor. A data breach is bad, regardless of if it’s a hack or if it’s somebody accidentally leaving a pile of printed PII on a bus, even if most piles of paper left on busses are just trash.