“For the curl bug, which should probably not be scored at all, NVD initially came up with a "9.8 critical", scoring an integer overflow in a delay parameter as one of the most severe types of vulnerability possible.”
The bug was a retry delay multiplied by 1000 without an overflow check, fixed in curl 7.66.0 in September 2019. Four years later someone filed CVE-2020-19909 without telling the project, and NVD stamped it critical without reading the patch attached to the report. The curl maintainers, who document more than 140 real CVEs themselves, found out from a mailing list. Every scanner and compliance checklist now flags a harmless bug as a 9.8, and the people who wrote the fix pay for it in support tickets.