“Typical server latency is likely “slow” enough to trigger this bug without an attacker needing to influence it by DoS or SOCKS server control.”
The bug sat in libcurl from 7.69.0 through 8.3.0, born when the SOCKS5 handshake was rewritten as a non-blocking state machine. A slow handshake flips one local variable, and curl copies a hostname of up to 65535 bytes into a 16kB heap buffer. Normal network lag is slow enough. The curl tool dodges it with a 100kB buffer, but every app that embeds libcurl with the default size does not, and most of them never tell you they ship curl.