curl -- HTTP headers eat all memory

selmelc on hackerone reports:

    When curl retrieves an HTTP response, it stores the
    incoming headers so that they can be accessed later via
    the libcurl headers API.
  

    However, curl did not have a limit in how many or how
    large headers it would accept in a response, allowing a
    malicious server to stream an endless series of headers
    and eventually cause curl to run out of heap memory.