Trail of Bits performed a security audit of curl's HTTP/3 components, published on February 23, 2024.
Trail of Bits performed a security audit of curl source code and internals, published on December 21, 2022.
See Threat Model Report & Fix Review and Code Review & Testing Analysis.
Cure 53 performed a security audit, published in August 2016.