CVE-2016-8624

curl before version 7.51.0 doesn’t parse the authority component of the URL
correctly when the host name part ends with a ‘#’ character, and could
instead be tricked into connecting to a different host. This may have
security implications if you for example use an URL parser that follows the
RFC to check for allowed domains before using curl to request them.