The recent patch of a 25-year-old Curl vulnerability raises concerns about persistent security gaps in widely used open source software.