Integer Overflow in curl retry delay handling

CVE-2020-19909 is an integer overflow in curl 7.65.2 in tool_operate.c when processing a very large retry delay value. The issue is triggered via the retry-delay option, where an excessively large user-supplied delay can overflow internal arithmetic and be interpreted as a much smaller value than intended. Available reporting indicates this occurs in curl’s command-line retry handling rather than in a remotely reachable protocol parser. The practical security significance is disputed, because exploitation depends on supplying an unusually large delay value corresponding to waits of weeks or longer, and the resulting behavior is primarily incorrect retry timing rather than memory corruption leading to code execution.