Comment by OliverGuy

Curl is one of the most audited code bases, so that's not surprising.

Put it in front of a common-ish Python or NPM package and see what it finds, likely going to be a lot more.